From 9e2e09a168f7ae9bd98a34a101dc7bc508b6fded Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 25 Mar 2022 13:26:16 -0700 Subject: [PATCH] Added filter macro --- ..._indirect_command_execution_via_pcalua.yml | 2 +- dist/escu/default/macros.conf | 7086 +++++++++-------- 2 files changed, 3750 insertions(+), 3338 deletions(-) diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml index baeba46177..608929175e 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml @@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_path | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_indirect_command_execution_via_pcaluafilter`' + | `windows_indirect_command_execution_via_pcalua_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the full process path in the process field of CIM's Process data model. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 599b52e09d..3d3cf545f9 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,3342 +1,10 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-24T08:24:11 UTC +# On Date: 2022-03-03T18:16:55 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# -[abnormally_high_number_of_cloud_infrastructure_api_calls_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[abnormally_high_number_of_cloud_security_group_api_calls_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_create_policy_version_to_allow_all_resources_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_createaccesskey_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_createloginprofile_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_cross_account_activity_from_previously_unseen_account_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_detect_users_with_kms_keys_performing_encryption_s3_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_ecr_container_scanning_findings_high_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_ecr_container_scanning_findings_low_informational_unknown_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_ecr_container_scanning_findings_medium_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_ecr_container_upload_outside_business_hours_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_ecr_container_upload_unknown_user_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_excessive_security_scanning_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_iam_accessdenied_discovery_events_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_iam_assume_role_policy_brute_force_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_iam_delete_policy_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_iam_failure_group_deletion_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_iam_successful_group_deletion_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_lambda_updatefunctioncode_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_network_access_control_list_created_with_all_open_ports_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_network_access_control_list_deleted_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_saml_access_by_provider_user_and_principal_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_saml_update_identity_provider_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_setdefaultpolicyversion_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_updateloginprofile_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[circle_ci_disable_security_job_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[circle_ci_disable_security_step_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cloud_api_calls_from_previously_unseen_user_roles_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cloud_compute_instance_created_by_previously_unseen_user_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cloud_compute_instance_created_in_previously_unused_region_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cloud_compute_instance_created_with_previously_unseen_image_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cloud_compute_instance_created_with_previously_unseen_instance_type_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cloud_instance_modified_by_previously_unseen_user_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cloud_provisioning_activity_from_previously_unseen_city_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cloud_provisioning_activity_from_previously_unseen_country_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cloud_provisioning_activity_from_previously_unseen_ip_address_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cloud_provisioning_activity_from_previously_unseen_region_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[correlation_by_repository_and_risk_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[correlation_by_user_and_risk_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_aws_console_login_by_new_user_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_aws_console_login_by_user_from_new_city_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_aws_console_login_by_user_from_new_country_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_aws_console_login_by_user_from_new_region_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_new_open_s3_buckets_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_new_open_s3_buckets_over_aws_cli_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_shared_ec2_snapshot_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[github_commit_changes_in_master_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[github_commit_in_develop_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[github_dependabot_alert_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[github_pull_request_from_unknown_user_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gsuite_drive_share_in_external_email_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gsuite_email_suspicious_attachment_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gsuite_email_suspicious_subject_with_attachment_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gsuite_email_with_known_abuse_web_service_link_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gsuite_outbound_email_with_attachment_to_external_domain_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gsuite_suspicious_shared_file_name_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_nginx_ingress_lfi_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_nginx_ingress_rfi_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_scanner_image_pulling_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[o365_add_app_role_assignment_grant_user_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[o365_added_service_principal_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[o365_bypass_mfa_via_trusted_ip_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[o365_disable_mfa_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[o365_excessive_authentication_failures_alert_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[o365_excessive_sso_logon_errors_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[o365_new_federated_domain_added_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[o365_pst_export_alert_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[o365_suspicious_admin_email_forwarding_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[o365_suspicious_rights_delegation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[o365_suspicious_user_email_forwarding_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[abnormally_high_aws_instances_launched_by_user_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[abnormally_high_aws_instances_launched_by_user___mltk_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[abnormally_high_aws_instances_terminated_by_user_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[abnormally_high_aws_instances_terminated_by_user___mltk_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_cloud_provisioning_from_previously_unseen_city_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_cloud_provisioning_from_previously_unseen_country_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_cloud_provisioning_from_previously_unseen_ip_address_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_cloud_provisioning_from_previously_unseen_region_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[clients_connecting_to_multiple_dns_servers_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cloud_network_access_control_list_deleted_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_api_activity_from_users_without_mfa_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_aws_api_activities_from_unapproved_accounts_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_long_dns_txt_record_response_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_mimikatz_via_powershell_and_eventcode_4703_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_new_api_calls_from_user_roles_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_new_user_aws_console_login_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_spike_in_aws_api_activity_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_spike_in_network_acl_activity_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_spike_in_security_group_activity_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_usb_device_insertion_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_web_traffic_to_dynamic_domain_providers_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detection_of_dns_tunnels_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[dns_query_requests_resolved_by_unauthorized_dns_servers_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[dns_record_changed_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[dump_lsass_via_procdump_rename_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ec2_instance_modified_with_previously_unseen_user_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ec2_instance_started_in_previously_unseen_region_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ec2_instance_started_with_previously_unseen_ami_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ec2_instance_started_with_previously_unseen_instance_type_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ec2_instance_started_with_previously_unseen_user_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[execution_of_file_with_spaces_before_extension_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[extended_period_without_successful_netbackup_backups_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[first_time_seen_command_line_argument_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gcp_detect_accounts_with_high_risk_roles_by_project_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gcp_detect_high_risk_permissions_by_resource_and_account_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gcp_detect_oauth_token_abuse_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gcp_gcr_container_uploaded_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gcp_kubernetes_cluster_scan_detection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[identify_new_user_accounts_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_aws_detect_most_active_service_accounts_by_pod_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_aws_detect_rbac_authorization_by_account_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_eks_kubernetes_cluster_sensitive_object_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_aws_detect_sensitive_role_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_aws_detect_service_accounts_forbidden_failure_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_azure_active_service_accounts_by_pod_namespace_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_azure_detect_rbac_authorization_by_account_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_azure_detect_sensitive_object_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_azure_detect_sensitive_role_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_azure_detect_suspicious_kubectl_calls_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_azure_pod_scan_fingerprint_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_azure_scan_fingerprint_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_gcp_detect_rbac_authorizations_by_account_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_gcp_detect_sensitive_object_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_gcp_detect_sensitive_role_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_gcp_detect_service_accounts_forbidden_failure_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_gcp_detect_suspicious_kubectl_calls_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[monitor_dns_for_brand_abuse_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[open_redirect_in_splunk_web_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[osquery_pack___coldroot_detection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[processes_created_by_netsh_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[prohibited_software_on_endpoint_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[reg_exe_used_to_hide_files_directories_via_registry_keys_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_registry_key_modifications_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[scheduled_tasks_used_in_badrabbit_ransomware_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[spectre_and_meltdown_vulnerable_systems_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[splunk_enterprise_information_disclosure_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_changes_to_file_associations_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_email___uba_anomaly_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_file_write_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_powershell_command_line_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_rundll32_rename_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_writes_to_system_volume_information_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[uncommon_processes_on_endpoint_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[unsigned_image_loaded_by_lsass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[unsuccessful_netbackup_backups_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[web_fraud___account_harvesting_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[web_fraud___anomalous_user_clickspeed_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[web_fraud___password_sharing_across_accounts_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_connhost_exe_started_forcefully_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_hosts_file_modification_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[7zip_commandline_to_smb_share_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[access_lsass_memory_for_dump_creation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[account_discovery_with_net_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[active_setup_registry_autostart_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[add_defaultuser_and_password_in_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[add_or_set_windows_defender_exclusion_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[adsisearcher_account_discovery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[allow_file_and_printing_sharing_in_firewall_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[allow_inbound_traffic_by_firewall_rule_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[allow_inbound_traffic_in_firewall_rule_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[allow_network_discovery_in_firewall_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[allow_operation_with_consent_admin_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[anomalous_usage_of_7zip_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[any_powershell_downloadfile_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[any_powershell_downloadstring_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[attacker_tools_on_endpoint_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[attempt_to_add_certificate_to_untrusted_store_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[attempt_to_stop_security_service_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[attempted_credential_dump_from_registry_via_reg_exe_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[auto_admin_logon_registry_entry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[batch_file_write_to_system32_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[bcdedit_command_back_to_normal_mode_boot_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[bcdedit_failure_recovery_modification_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[bits_job_persistence_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[bitsadmin_download_file_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[certutil_download_with_urlcache_and_split_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[certutil_download_with_verifyctl_and_split_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[certutil_exe_certificate_extraction_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[certutil_with_decode_argument_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[change_default_file_association_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[change_to_safe_mode_with_network_config_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[chcp_command_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[check_elevated_cmd_using_whoami_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[clear_unallocated_sector_using_cipher_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[clop_common_exec_parameter_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[clop_ransomware_known_service_name_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cmd_carry_out_string_command_parameter_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cmd_echo_pipe___escalation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cmdline_tool_not_executed_in_cmd_shell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cmlua_or_cmstplua_uac_bypass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[cobalt_strike_named_pipes_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[common_ransomware_extensions_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[common_ransomware_notes_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[conti_common_exec_parameter_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[control_loading_from_world_writable_directory_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[create_local_admin_accounts_using_net_exe_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[create_or_delete_windows_shares_using_net_exe_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[create_remote_thread_in_shell_application_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[create_remote_thread_into_lsass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[creation_of_lsass_dump_with_taskmgr_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[creation_of_shadow_copy_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[creation_of_shadow_copy_with_wmic_and_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[credential_dumping_via_copy_command_from_shadow_copy_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[credential_dumping_via_symlink_to_shadow_copy_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[csc_net_on_the_fly_compilation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[curl_download_and_bash_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[delete_shadowcopy_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[deleting_of_net_users_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[deleting_shadow_copies_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_activity_related_to_pass_the_hash_attacks_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_azurehound_command_line_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_azurehound_file_modifications_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_copy_of_shadowcopy_with_script_block_logging_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_credential_dumping_through_lsass_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_empire_with_powershell_script_block_logging_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_excessive_account_lockouts_from_endpoint_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_excessive_user_account_lockouts_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_exchange_web_shell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_html_help_renamed_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_html_help_spawn_child_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_html_help_url_in_command_line_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_html_help_using_infotech_storage_handlers_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_mimikatz_using_loaded_images_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_mimikatz_with_powershell_script_block_logging_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_mshta_inline_hta_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_mshta_renamed_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_mshta_url_in_command_line_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_new_local_admin_account_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_path_interception_by_creation_of_program_exe_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_processes_used_for_system_network_configuration_discovery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_prohibited_applications_spawning_cmd_exe_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_psexec_with_accepteula_flag_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_rclone_command_line_usage_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_regasm_spawning_a_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_regasm_with_network_connection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_regasm_with_no_command_line_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_regsvcs_spawning_a_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_regsvcs_with_network_connection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_regsvcs_with_no_command_line_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_regsvr32_application_control_bypass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_renamed_7_zip_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_renamed_psexec_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_renamed_rclone_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_renamed_winrar_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_rundll32_application_control_bypass___advpack_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_rundll32_application_control_bypass___setupapi_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_rundll32_application_control_bypass___syssetup_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_rundll32_inline_hta_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_sharphound_command_line_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_sharphound_file_modifications_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_sharphound_usage_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_use_of_cmd_exe_to_launch_script_interpreters_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_wmi_event_subscription_persistence_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_amsi_through_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_defender_antivirus_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_defender_blockatfirstseen_feature_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_defender_enhanced_notification_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_defender_mpengine_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_defender_spynet_reporting_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_defender_submit_samples_consent_feature_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_etw_through_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_logs_using_wevtutil_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_registry_tool_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_schedule_task_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_security_logs_using_minint_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_show_hidden_files_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_uac_remote_restriction_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_windows_app_hotkeys_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_windows_behavior_monitoring_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disable_windows_smartscreen_protection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabled_kerberos_pre_authentication_discovery_with_powerview_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabling_cmd_application_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabling_controlpanel_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabling_defender_services_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabling_firewall_with_netsh_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabling_folderoptions_windows_feature_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabling_net_user_account_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabling_norun_windows_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabling_remote_user_account_control_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabling_systemrestore_in_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[disabling_task_manager_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[dllhost_with_no_command_line_arguments_with_network_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[dns_exfiltration_using_nslookup_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[domain_account_discovery_with_dsquery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[domain_account_discovery_with_net_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[domain_account_discovery_with_wmic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[domain_controller_discovery_with_nltest_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[domain_controller_discovery_with_wmic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[domain_group_discovery_with_adsisearcher_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[domain_group_discovery_with_dsquery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[domain_group_discovery_with_net_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[domain_group_discovery_with_wmic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[download_files_using_telegram_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[drop_icedid_license_dat_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[dsquery_domain_discovery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[dump_lsass_via_comsvcs_dll_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[dump_lsass_via_procdump_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[elevated_group_discovery_with_net_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[elevated_group_discovery_with_powerview_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[elevated_group_discovery_with_wmic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[enable_rdp_in_other_port_number_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[enable_wdigest_uselogoncredential_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[enumerate_users_local_group_using_telegram_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[esentutl_sam_copy_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[etw_registry_disabled_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[eventvwr_uac_bypass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excel_spawning_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excel_spawning_windows_script_host_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_attempt_to_disable_services_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_distinct_processes_from_windows_temp_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_file_deletion_in_windefender_folder_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_number_of_service_control_start_as_disabled_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_number_of_taskhost_processes_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_service_stop_attempt_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_usage_of_cacls_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_usage_of_net_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_usage_of_nslookup_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_usage_of_sc_service_utility_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_usage_of_taskkill_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[executable_file_written_in_administrative_smb_share_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[executables_or_script_creation_in_suspicious_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[execute_javascript_with_jscript_com_clsid_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[execution_of_file_with_multiple_extensions_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[extraction_of_registry_hives_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[file_with_samsam_extension_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[firewall_allowed_program_enable_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[fodhelper_uac_bypass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[fsutil_zeroing_file_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_addefaultdomainpasswordpolicy_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_aduser_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_aduser_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_aduserresultantpasswordpolicy_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_aduserresultantpasswordpolicy_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_domainpolicy_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_domainpolicy_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_domaintrust_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_domaintrust_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_domainuser_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_domainuser_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_foresttrust_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_foresttrust_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_wmiobject_group_discovery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[get_wmiobject_group_discovery_with_script_block_logging_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getadcomputer_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getadcomputer_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getadgroup_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getadgroup_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getcurrent_user_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getcurrent_user_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getdomaincomputer_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getdomaincomputer_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getdomaincontroller_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getdomaincontroller_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getdomaingroup_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getdomaingroup_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getlocaluser_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getlocaluser_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getnettcpconnection_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getnettcpconnection_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getwmiobject_ds_computer_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getwmiobject_ds_computer_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getwmiobject_ds_group_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getwmiobject_ds_group_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getwmiobject_ds_user_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getwmiobject_ds_user_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getwmiobject_user_account_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[getwmiobject_user_account_with_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gpupdate_with_no_command_line_arguments_with_network_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[hide_user_account_from_sign_in_screen_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[hiding_files_and_directories_with_attrib_exe_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[high_frequency_copy_of_files_in_network_share_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[high_process_termination_frequency_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[hunting_for_log4shell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[icacls_deny_command_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[icacls_grant_command_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[icedid_exfiltrated_archived_file_creation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[impacket_lateral_movement_commandline_parameters_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[interactive_session_on_remote_endpoint_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[java_class_file_download_by_java_user_agent_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[jscript_execution_using_cscript_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kerberoasting_spn_request_with_rc4_encryption_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kerberos_pre_authentication_flag_disabled_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[known_services_killed_by_ransomware_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_add_files_in_known_crontab_directories_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_add_user_account_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_at_allow_config_file_creation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_at_application_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_change_file_owner_to_root_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_common_process_for_elevation_control_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_dd_file_overwrite_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_doas_conf_file_creation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_doas_tool_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_edit_cron_table_parameter_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_file_created_in_kernel_driver_directory_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_file_creation_in_init_boot_directory_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_file_creation_in_profile_directory_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_insert_kernel_module_using_insmod_utility_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_install_kernel_module_using_modprobe_utility_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_java_spawning_shell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_nopasswd_entry_in_sudoers_file_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_pkexec_privilege_escalation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_possible_access_or_modification_of_sshd_config_file_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_possible_access_to_credential_files_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_possible_access_to_sudoers_file_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_possible_append_command_to_at_allow_config_file_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_possible_append_command_to_profile_config_file_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_possible_cronjob_modification_with_editor_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_possible_ssh_key_file_creation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_preload_hijack_library_calls_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_service_file_created_in_systemd_directory_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_service_restarted_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_service_started_or_enabled_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_setuid_using_chmod_utility_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_setuid_using_setcap_utility_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_sudo_or_su_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_sudoers_tmp_file_creation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_system_network_discovery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[linux_visudo_utility_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[loading_of_dynwrapx_module_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[local_account_discovery_with_net_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[local_account_discovery_with_wmic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[log4shell_cve_2021_44228_exploitation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[logon_script_event_trigger_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[macos_lolbin_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[mailsniper_invoke_functions_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[malicious_inprocserver32_modification_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[malicious_powershell_executed_as_a_service_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[malicious_powershell_process___encoded_command_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[malicious_powershell_process___execution_policy_bypass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[malicious_powershell_process_with_obfuscation_techniques_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[mimikatz_passtheticket_commandline_parameters_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[mmc_lolbas_execution_process_spawn_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[modification_of_wallpaper_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[modify_acl_permission_to_files_or_folder_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[monitor_registry_keys_for_print_monitors_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ms_scripting_process_loading_ldap_module_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ms_scripting_process_loading_wmi_module_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[msbuild_suspicious_spawned_by_script_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[mshta_spawning_rundll32_or_regsvr32_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[mshtml_module_load_in_office_product_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[msi_module_loaded_by_non_system_binary_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[msmpeng_application_dll_side_loading_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[multiple_users_failing_to_authenticate_from_host_using_kerberos_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[multiple_users_failing_to_authenticate_from_host_using_ntlm_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[multiple_users_failing_to_authenticate_from_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[multiple_users_remotely_failing_to_authenticate_from_host_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[net_localgroup_discovery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[net_profiler_uac_bypass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[network_connection_discovery_with_arp_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[network_connection_discovery_with_net_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[network_connection_discovery_with_netstat_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[network_discovery_using_route_windows_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[nishang_powershelltcponeline_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[nltest_domain_trust_discovery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[non_chrome_process_accessing_chrome_default_dir_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[non_firefox_process_access_firefox_profile_dir_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ntdsutil_export_ntds_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_application_drop_executable_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_application_spawn_regsvr32_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_application_spawn_rundll32_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_document_creating_schedule_task_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_document_executing_macro_code_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_document_spawned_child_process_to_download_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_product_spawn_cmd_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_product_spawning_bitsadmin_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_product_spawning_certutil_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_product_spawning_mshta_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_product_spawning_rundll32_with_no_dll_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_product_spawning_wmic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_product_writing_cab_or_inf_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[office_spawning_control_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[outbound_network_connection_from_java_using_default_ports_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[overwriting_accessibility_binaries_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[password_policy_discovery_with_net_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[permission_modification_using_takeown_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[petitpotam_network_share_access_request_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[petitpotam_suspicious_kerberos_tgt_request_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ping_sleep_batch_command_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[possible_browser_pass_view_parameter_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[possible_lateral_movement_powershell_spawn_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[potentially_malicious_code_on_commandline_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_4104_hunting_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell___connect_to_internet_with_hidden_window_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_creating_thread_mutex_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_disable_security_monitoring_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_domain_enumeration_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_enable_smb1protocol_feature_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_execute_com_object_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_fileless_process_injection_via_getprocaddress_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_fileless_script_contains_base64_encoded_content_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_get_localgroup_discovery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_get_localgroup_discovery_with_script_block_logging_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_loading_dotnet_into_memory_via_reflection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_processing_stream_of_data_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_remote_thread_to_known_windows_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_remove_windows_defender_directory_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_start_bitstransfer_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_using_memory_as_backing_store_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[powershell_windows_defender_exclusion_commands_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[prevent_automatic_repair_mode_using_bcdedit_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[print_spooler_adding_a_printer_driver_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[print_spooler_failed_to_load_a_plug_in_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[process_creating_lnk_file_in_suspicious_location_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[process_deleting_its_process_file_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[process_execution_via_wmi_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[process_kill_base_on_file_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[process_writing_dynamicwrapperx_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[processes_launching_netsh_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ransomware_notes_bulk_creation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[recon_avproduct_through_pwh_or_wmi_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[recon_using_wmi_class_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[recursive_delete_of_directory_in_batch_cmd_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[reg_exe_manipulating_windows_services_registry_keys_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[registry_keys_for_creating_shim_databases_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[registry_keys_used_for_persistence_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[registry_keys_used_for_privilege_escalation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[regsvr32_silent_and_install_param_dll_loading_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[regsvr32_with_known_silent_switch_cmdline_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remcos_client_registry_install_entry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remcos_rat_file_creation_in_remcos_folder_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_process_instantiation_via_dcom_and_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_process_instantiation_via_dcom_and_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_process_instantiation_via_winrm_and_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_process_instantiation_via_winrm_and_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_process_instantiation_via_winrm_and_winrs_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_process_instantiation_via_wmi_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_process_instantiation_via_wmi_and_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_process_instantiation_via_wmi_and_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_system_discovery_with_adsisearcher_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_system_discovery_with_dsquery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_system_discovery_with_net_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_system_discovery_with_wmic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_wmi_command_attempt_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[resize_shadowstorage_volume_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[revil_common_exec_parameter_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[revil_registry_entry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[rubeus_command_line_parameters_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[rubeus_kerberos_ticket_exports_through_winlogon_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[runas_execution_in_commandline_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[rundll32_control_rundll_hunt_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[rundll32_control_rundll_world_writable_directory_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[rundll32_create_remote_thread_to_a_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[rundll32_createremotethread_in_browser_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[rundll32_dnsquery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[rundll32_process_creating_exe_dll_files_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[rundll32_shimcache_flush_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[rundll32_with_no_command_line_arguments_with_network_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[rundll_loading_dll_by_ordinal_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ryuk_test_files_detected_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ryuk_wake_on_lan_command_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[sam_database_file_access_attempt_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[samsam_test_file_write_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[sc_exe_manipulating_windows_services_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[schcache_change_by_app_connect_and_create_adsi_object_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[schedule_task_with_http_command_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[schedule_task_with_rundll32_command_trigger_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[scheduled_task_creation_on_remote_endpoint_using_at_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[scheduled_task_deleted_or_created_via_cmd_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[scheduled_task_initiation_on_remote_endpoint_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[schtasks_run_task_on_demand_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[schtasks_scheduling_job_on_remote_system_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[schtasks_used_for_forcing_a_reboot_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[screensaver_event_trigger_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[script_execution_via_wmi_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[sdclt_uac_bypass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[sdelete_application_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[searchprotocolhost_with_no_command_line_with_network_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[secretdumps_offline_ntds_dumping_tool_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[serviceprincipalnames_discovery_with_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[serviceprincipalnames_discovery_with_setspn_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[services_escalate_exe_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[services_lolbas_execution_process_spawn_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[shim_database_file_creation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[shim_database_installation_with_suspicious_parameters_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[short_lived_scheduled_task_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[short_lived_windows_accounts_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[silentcleanup_uac_bypass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[single_letter_process_on_endpoint_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[slui_runas_elevated_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[slui_spawning_a_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[spoolsv_spawning_rundll32_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[spoolsv_suspicious_loaded_modules_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[spoolsv_suspicious_process_access_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[spoolsv_writing_a_dll_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[spoolsv_writing_a_dll___sysmon_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[sqlite_module_in_temp_folder_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[start_up_during_safe_mode_boot_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_computer_account_name_change_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_copy_on_system32_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_dllhost_no_command_line_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_driver_loaded_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_event_log_service_behavior_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_gpupdate_no_command_line_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_icedid_rundll32_cmdline_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_image_creation_in_appdata_folder_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_kerberos_service_ticket_request_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_linux_discovery_commands_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_microsoft_workflow_compiler_rename_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_microsoft_workflow_compiler_usage_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_msbuild_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_msbuild_rename_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_msbuild_spawn_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_mshta_child_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_mshta_spawn_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_process_dns_query_known_abuse_web_services_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_process_file_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_process_with_discord_dns_query_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_reg_exe_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_regsvr32_register_suspicious_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_rundll32_dllregisterserver_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_rundll32_plugininit_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_rundll32_startw_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_rundll32_no_command_line_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_scheduled_task_from_public_directory_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_searchprotocolhost_no_command_line_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_ticket_granting_ticket_request_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_wav_file_in_appdata_folder_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_wevtutil_usage_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_writes_to_windows_recycle_bin_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[svchost_lolbas_execution_process_spawn_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[system_info_gathering_using_dxdiag_application_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[system_information_discovery_detection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[system_processes_run_from_unexpected_locations_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[system_user_discovery_with_query_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[system_user_discovery_with_whoami_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[time_provider_persistence_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[trickbot_named_pipe_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[uac_bypass_mmc_load_unsigned_dll_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[uac_bypass_with_colorui_com_object_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[unified_messaging_service_spawning_a_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[uninstall_app_using_msiexec_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[unload_sysmon_filter_driver_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[unloading_amsi_via_reflection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[unusual_number_of_kerberos_service_tickets_requested_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[user_discovery_with_env_vars_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[user_discovery_with_env_vars_powershell_script_block_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[usn_journal_deletion_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[vbscript_execution_using_wscript_app_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[verclsid_clsid_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[w3wp_spawning_shell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wbadmin_delete_system_backups_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wbemprox_com_object_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wermgr_process_connecting_to_ip_check_web_services_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wermgr_process_create_executable_file_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wermgr_process_spawned_cmd_or_powershell_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wget_download_and_bash_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_adfind_exe_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_curl_download_to_suspicious_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_curl_upload_to_remote_destination_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_defender_exclusion_registry_entry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_disable_change_password_through_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_disable_lock_workstation_feature_through_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_disable_logoff_button_through_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_disable_memory_crash_dump_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_disable_notification_center_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_disable_shutdown_button_through_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_disable_windows_group_policy_features_through_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_disableantispyware_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_disabled_users_failing_to_authenticate_kerberos_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_diskcryptor_usage_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_diskshadow_proxy_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_dism_remove_defender_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_dotnet_binary_in_non_standard_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_event_for_service_disabled_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_event_log_cleared_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_excessive_disabled_services_event_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_file_without_extension_in_critical_folder_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_hide_notification_features_through_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_high_file_deletion_frequency_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_hunting_system_account_targeting_lsass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_installutil_credential_theft_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_installutil_in_non_standard_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_installutil_remote_network_connection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_installutil_uninstall_option_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_installutil_uninstall_option_with_network_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_installutil_url_in_command_line_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_invalid_users_failed_authentication_via_kerberos_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_modify_show_compress_color_and_info_tip_registry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_nirsoft_advancedrun_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_nirsoft_utilities_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_non_system_account_targeting_lsass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_possible_credential_dumping_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_process_with_namedpipe_commandline_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_raccine_scheduled_task_deletion_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_rasautou_dll_execution_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_raw_access_to_disk_volume_partition_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_raw_access_to_master_boot_record_drive_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_remote_assistance_spawning_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_schtasks_create_run_as_system_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_security_account_manager_stopped_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_service_created_with_suspicious_service_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_service_created_within_public_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_service_creation_on_remote_endpoint_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_service_creation_using_registry_entry_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_service_initiation_on_remote_endpoint_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_users_authenticate_using_explicit_credentials_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_wmi_process_call_create_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[winevent_scheduled_task_created_to_spawn_shell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[winevent_scheduled_task_created_within_public_path_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[winevent_windows_task_scheduler_event_action_started_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[winhlp32_spawning_a_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[winword_spawning_cmd_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[winword_spawning_powershell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[winword_spawning_windows_script_host_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wmi_permanent_event_subscription___sysmon_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wmi_recon_running_process_or_services_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wmic_group_discovery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wmic_noninteractive_app_uninstallation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wmic_xsl_execution_via_url_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wmiprsve_lolbas_execution_process_spawn_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wscript_or_cscript_suspicious_child_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wsmprovhost_lolbas_execution_process_spawn_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wsreset_uac_bypass_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[xmrig_driver_loaded_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[xsl_script_execution_with_wmic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_new_login_attempts_to_routers_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[email_attachments_with_lots_of_spaces_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[email_files_written_outside_of_the_outlook_directory_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[email_servers_sending_high_volume_traffic_to_hosts_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[monitor_email_for_brand_abuse_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[no_windows_updates_in_a_time_frame_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[okta_account_lockout_events_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[okta_failed_sso_attempts_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[okta_user_logins_from_multiple_cities_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_email_attachment_extensions_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_java_classes_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[web_servers_executing_suspicious_processes_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[abnormally_high_number_of_cloud_instances_destroyed_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[abnormally_high_number_of_cloud_instances_launched_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[amazon_eks_kubernetes_cluster_scan_detection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[amazon_eks_kubernetes_pod_scan_detection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_detect_attach_to_role_policy_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_detect_permanent_key_creation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_detect_role_creation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_detect_sts_assume_role_abuse_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[aws_detect_sts_get_session_token_abuse_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_gcp_storage_access_from_a_new_ip_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_new_open_gcp_storage_buckets_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_s3_access_from_a_new_ip_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_spike_in_aws_security_hub_alerts_for_user_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_spike_in_blocked_outbound_traffic_from_your_aws_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_spike_in_s3_bucket_deletion_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gcp_detect_gcploit_framework_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gcp_kubernetes_cluster_pod_scan_detection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gdrive_suspicious_file_sharing_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[gsuite_suspicious_calendar_invite_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[high_number_of_login_failures_from_a_single_source_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[kubernetes_aws_detect_suspicious_kubectl_calls_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[new_container_uploaded_to_aws_ecr_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[child_processes_of_spoolsv_exe_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_baron_samedit_cve_2021_3156_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_baron_samedit_cve_2021_3156_segfault_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_baron_samedit_cve_2021_3156_via_osquery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_computer_changed_with_anonymous_account_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_outlook_exe_writing_a_zip_file_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_rare_executables_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detection_of_tools_built_by_nirsoft_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[exchange_powershell_abuse_via_ssrf_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[exchange_powershell_module_usage_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[first_time_seen_child_process_of_zoom_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[first_time_seen_running_windows_service_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[macos___re_opened_applications_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[ms_exchange_mailbox_replication_service_writing_active_server_pages_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[print_processor_registry_autostart_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[processes_tapping_keyboard_events_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[randomly_generated_scheduled_task_name_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[randomly_generated_windows_service_name_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_desktop_process_running_on_system_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[spike_in_file_writes_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[sunburst_correlation_dll_and_network_event_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_curl_network_connection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_plistbuddy_usage_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_plistbuddy_usage_via_osquery_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[suspicious_sqlite3_lsquarantine_behavior_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[unusual_number_of_computer_service_tickets_requested_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[unusual_number_of_remote_endpoint_authentication_events_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[unusually_long_command_line_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[unusually_long_command_line___mltk_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[windows_java_spawning_shells_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[winrm_spawning_a_process_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wmi_permanent_event_subscription_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[wmi_temporary_event_subscription_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_arp_poisoning_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_ipv6_network_infrastructure_threats_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_large_outbound_icmp_packets_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_outbound_smb_traffic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_port_security_violation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_rogue_dhcp_server_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_snicat_sni_exfiltration_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_software_download_to_network_device_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_traffic_mirroring_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_unauthorized_assets_by_mac_address_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_windows_dns_sigred_via_splunk_stream_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_windows_dns_sigred_via_zeek_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_zerologon_via_zeek_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[dns_query_length_outliers___mltk_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[excessive_dns_failures_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[hosts_receiving_high_volume_of_network_traffic_from_email_server_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[large_volume_of_dns_any_queries_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[prohibited_network_traffic_allowed_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[protocol_or_port_mismatch_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[protocols_passing_authentication_in_cleartext_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_desktop_network_bruteforce_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[remote_desktop_network_traffic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[smb_traffic_spike_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[smb_traffic_spike___mltk_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[tor_traffic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[unusually_long_content_type_length_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_attackers_scanning_for_vulnerable_jboss_servers_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_f5_tmui_rce_cve_2020_5902_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_malicious_requests_to_exploit_jboss_servers_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[monitor_web_traffic_for_brand_abuse_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[sql_injection_with_long_urls_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[supernova_webshell_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_hosts_connecting_to_dynamic_domain_providers_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[detect_outbound_ldap_traffic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[dns_query_length_with_high_standard_deviation_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[multiple_archive_files_http_post_traffic_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[plain_http_post_exfiltrated_data_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[log4shell_jndi_payload_injection_attempt_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[log4shell_jndi_payload_injection_with_outbound_connection_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - [aws_cloudwatchlogs_eks] definition = sourcetype="aws:cloudwatchlogs:eks" @@ -3538,10 +206,6 @@ description = customer specific splunk configurations(eg- index, source, sourcet definition = eventtype=okta_log description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. -[osquery] -definition = sourcetype=osquery:results -description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. - [osquery_process] definition = eventtype="osquery-process" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. @@ -3883,3 +547,3751 @@ description = customer specific splunk configurations(eg- index, source, sourcet definition = index=zeek sourcetype="zeek:ssl:json" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +[7zip_commandline_to_smb_share_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_cloud_provisioning_from_previously_unseen_city_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_cloud_provisioning_from_previously_unseen_country_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_cloud_provisioning_from_previously_unseen_ip_address_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_cloud_provisioning_from_previously_unseen_region_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_create_policy_version_to_allow_all_resources_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_createaccesskey_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_createloginprofile_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_cross_account_activity_from_previously_unseen_account_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_detect_users_with_kms_keys_performing_encryption_s3_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_ecr_container_scanning_findings_high_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_ecr_container_scanning_findings_low_informational_unknown_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_ecr_container_scanning_findings_medium_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_ecr_container_upload_outside_business_hours_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_ecr_container_upload_unknown_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_eks_kubernetes_cluster_sensitive_object_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_excessive_security_scanning_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_iam_accessdenied_discovery_events_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_iam_assume_role_policy_brute_force_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_iam_delete_policy_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_iam_failure_group_deletion_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_iam_successful_group_deletion_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_investigate_security_hub_alerts_by_dest_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_investigate_user_activities_by_arn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_investigate_user_activities_by_accesskeyid_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_lambda_updatefunctioncode_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_network_acl_details_from_id_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_network_access_control_list_created_with_all_open_ports_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_network_access_control_list_deleted_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_network_interface_details_via_resourceid_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_s3_bucket_details_via_bucketname_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_saml_access_by_provider_user_and_principal_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_saml_update_identity_provider_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_setdefaultpolicyversion_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_updateloginprofile_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[abnormally_high_aws_instances_launched_by_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[abnormally_high_aws_instances_launched_by_user___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[abnormally_high_aws_instances_terminated_by_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[abnormally_high_aws_instances_terminated_by_user___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[abnormally_high_number_of_cloud_infrastructure_api_calls_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[abnormally_high_number_of_cloud_instances_destroyed_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[abnormally_high_number_of_cloud_instances_launched_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[abnormally_high_number_of_cloud_security_group_api_calls_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[access_lsass_memory_for_dump_creation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[account_discovery_with_net_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[active_setup_registry_autostart_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[add_defaultuser_and_password_in_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[add_prohibited_processes_to_enterprise_security_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[add_or_set_windows_defender_exclusion_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[adsisearcher_account_discovery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[all_backup_logs_for_host_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[allow_file_and_printing_sharing_in_firewall_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[allow_inbound_traffic_by_firewall_rule_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[allow_inbound_traffic_in_firewall_rule_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[allow_network_discovery_in_firewall_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[allow_operation_with_consent_admin_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[amazon_eks_kubernetes_pod_scan_detection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[amazon_eks_kubernetes_activity_by_src_ip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[amazon_eks_kubernetes_cluster_scan_detection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[anomalous_usage_of_7zip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[any_powershell_downloadfile_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[any_powershell_downloadstring_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[attacker_tools_on_endpoint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[attempt_to_add_certificate_to_untrusted_store_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[attempt_to_stop_security_service_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[attempted_credential_dump_from_registry_via_reg_exe_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[auto_admin_logon_registry_entry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[bcdedit_failure_recovery_modification_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[bits_job_persistence_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[bitsadmin_download_file_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_cloud_infrastructure_api_calls_per_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_cloud_instances_destroyed_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_cloud_instances_launched_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_cloud_security_group_api_calls_per_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_api_calls_per_user_arn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_command_line_length___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_dns_query_length___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_excessive_aws_instances_launched_by_user___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_excessive_aws_instances_terminated_by_user___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_network_acl_activity_by_arn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_s3_bucket_deletion_activity_by_arn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_smb_traffic___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_security_group_activity_by_arn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_blocked_outbound_traffic_from_aws_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[batch_file_write_to_system32_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[bcdedit_command_back_to_normal_mode_boot_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[chcp_command_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cmd_carry_out_string_command_parameter_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cmd_echo_pipe___escalation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cmlua_or_cmstplua_uac_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[csc_net_on_the_fly_compilation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[certutil_download_with_urlcache_and_split_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[certutil_download_with_verifyctl_and_split_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[certutil_with_decode_argument_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[certutil_exe_certificate_extraction_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[change_default_file_association_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[change_to_safe_mode_with_network_config_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[check_elevated_cmd_using_whoami_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[child_processes_of_spoolsv_exe_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[circle_ci_disable_security_job_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[circle_ci_disable_security_step_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[clear_unallocated_sector_using_cipher_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[clients_connecting_to_multiple_dns_servers_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[clop_common_exec_parameter_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[clop_ransomware_known_service_name_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cloud_api_calls_from_previously_unseen_user_roles_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cloud_compute_instance_created_by_previously_unseen_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cloud_compute_instance_created_in_previously_unused_region_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cloud_compute_instance_created_with_previously_unseen_image_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cloud_compute_instance_created_with_previously_unseen_instance_type_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cloud_instance_modified_by_previously_unseen_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cloud_network_access_control_list_deleted_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cloud_provisioning_activity_from_previously_unseen_city_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cloud_provisioning_activity_from_previously_unseen_country_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cloud_provisioning_activity_from_previously_unseen_ip_address_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cloud_provisioning_activity_from_previously_unseen_region_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cmdline_tool_not_executed_in_cmd_shell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[cobalt_strike_named_pipes_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[common_ransomware_extensions_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[common_ransomware_notes_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[conti_common_exec_parameter_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[control_loading_from_world_writable_directory_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[correlation_by_repository_and_risk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[correlation_by_user_and_risk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[count_of_unique_ips_connecting_to_ports_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[count_of_assets_by_category_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[create_remote_thread_in_shell_application_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[create_remote_thread_into_lsass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[create_a_list_of_approved_aws_service_accounts_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[create_local_admin_accounts_using_net_exe_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[create_or_delete_windows_shares_using_net_exe_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[creation_of_shadow_copy_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[creation_of_shadow_copy_with_wmic_and_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[creation_of_lsass_dump_with_taskmgr_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[credential_dumping_via_copy_command_from_shadow_copy_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[credential_dumping_via_symlink_to_shadow_copy_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[curl_download_and_bash_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[dllhost_with_no_command_line_arguments_with_network_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[dns_exfiltration_using_nslookup_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[dns_query_length_outliers___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[dns_query_length_with_high_standard_deviation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[dns_query_requests_resolved_by_unauthorized_dns_servers_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[dns_record_changed_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[dnstwist_domain_names_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[dsquery_domain_discovery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[delete_shadowcopy_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[deleting_of_net_users_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[deleting_shadow_copies_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_api_activity_from_users_without_mfa_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_arp_poisoning_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_aws_api_activities_from_unapproved_accounts_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_aws_console_login_by_new_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_aws_console_login_by_user_from_new_city_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_aws_console_login_by_user_from_new_country_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_aws_console_login_by_user_from_new_region_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_activity_related_to_pass_the_hash_attacks_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_azurehound_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_azurehound_file_modifications_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_baron_samedit_cve_2021_3156_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_baron_samedit_cve_2021_3156_segfault_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_baron_samedit_cve_2021_3156_via_osquery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_computer_changed_with_anonymous_account_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_copy_of_shadowcopy_with_script_block_logging_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_credential_dumping_through_lsass_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_empire_with_powershell_script_block_logging_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_excessive_account_lockouts_from_endpoint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_excessive_user_account_lockouts_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_exchange_web_shell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_f5_tmui_rce_cve_2020_5902_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_gcp_storage_access_from_a_new_ip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_html_help_renamed_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_html_help_spawn_child_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_html_help_url_in_command_line_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_html_help_using_infotech_storage_handlers_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_ipv6_network_infrastructure_threats_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_large_outbound_icmp_packets_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_long_dns_txt_record_response_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_mshta_url_in_command_line_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_mimikatz_using_loaded_images_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_mimikatz_via_powershell_and_eventcode_4703_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_mimikatz_with_powershell_script_block_logging_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_new_local_admin_account_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_new_login_attempts_to_routers_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_new_open_gcp_storage_buckets_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_new_open_s3_buckets_over_aws_cli_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_new_open_s3_buckets_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_outbound_ldap_traffic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_outbound_smb_traffic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_outlook_exe_writing_a_zip_file_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_path_interception_by_creation_of_program_exe_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_port_security_violation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_prohibited_applications_spawning_cmd_exe_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_psexec_with_accepteula_flag_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_rclone_command_line_usage_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_rare_executables_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_regasm_spawning_a_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_regasm_with_network_connection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_regasm_with_no_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_regsvcs_spawning_a_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_regsvcs_with_network_connection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_regsvcs_with_no_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_regsvr32_application_control_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_renamed_7_zip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_renamed_psexec_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_renamed_rclone_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_renamed_winrar_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_rogue_dhcp_server_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_rundll32_application_control_bypass___advpack_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_rundll32_application_control_bypass___setupapi_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_rundll32_application_control_bypass___syssetup_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_rundll32_inline_hta_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_s3_access_from_a_new_ip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_snicat_sni_exfiltration_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_sharphound_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_sharphound_file_modifications_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_sharphound_usage_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_software_download_to_network_device_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_spike_in_aws_api_activity_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_spike_in_aws_security_hub_alerts_for_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_spike_in_network_acl_activity_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_spike_in_s3_bucket_deletion_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_spike_in_security_group_activity_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_spike_in_blocked_outbound_traffic_from_your_aws_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_traffic_mirroring_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_usb_device_insertion_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_unauthorized_assets_by_mac_address_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_use_of_cmd_exe_to_launch_script_interpreters_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_wmi_event_subscription_persistence_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_windows_dns_sigred_via_splunk_stream_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_windows_dns_sigred_via_zeek_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_zerologon_via_zeek_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_attackers_scanning_for_vulnerable_jboss_servers_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_hosts_connecting_to_dynamic_domain_providers_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_malicious_requests_to_exploit_jboss_servers_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_mshta_inline_hta_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_mshta_renamed_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_new_api_calls_from_user_roles_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_new_user_aws_console_login_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_processes_used_for_system_network_configuration_discovery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_shared_ec2_snapshot_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detect_web_traffic_to_dynamic_domain_providers_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detection_of_dns_tunnels_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[detection_of_tools_built_by_nirsoft_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_amsi_through_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_defender_antivirus_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_defender_blockatfirstseen_feature_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_defender_enhanced_notification_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_defender_mpengine_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_defender_spynet_reporting_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_defender_submit_samples_consent_feature_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_etw_through_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_logs_using_wevtutil_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_registry_tool_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_schedule_task_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_security_logs_using_minint_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_show_hidden_files_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_uac_remote_restriction_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_windows_app_hotkeys_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_windows_behavior_monitoring_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disable_windows_smartscreen_protection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabled_kerberos_pre_authentication_discovery_with_powerview_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabling_cmd_application_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabling_controlpanel_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabling_defender_services_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabling_firewall_with_netsh_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabling_folderoptions_windows_feature_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabling_net_user_account_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabling_norun_windows_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabling_remote_user_account_control_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabling_systemrestore_in_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[disabling_task_manager_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[discover_dns_records_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[domain_account_discovery_with_net_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[domain_account_discovery_with_dsquery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[domain_account_discovery_with_wmic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[domain_controller_discovery_with_nltest_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[domain_controller_discovery_with_wmic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[domain_group_discovery_with_dsquery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[domain_group_discovery_with_net_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[domain_group_discovery_with_wmic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[domain_group_discovery_with_adsisearcher_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[download_files_using_telegram_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[drop_icedid_license_dat_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[dump_lsass_via_comsvcs_dll_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[dump_lsass_via_procdump_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[dump_lsass_via_procdump_rename_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ec2_instance_modified_with_previously_unseen_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ec2_instance_started_in_previously_unseen_region_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ec2_instance_started_with_previously_unseen_ami_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ec2_instance_started_with_previously_unseen_instance_type_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ec2_instance_started_with_previously_unseen_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[etw_registry_disabled_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[elevated_group_discovery_with_net_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[elevated_group_discovery_with_wmic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[elevated_group_discovery_with_powerview_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[email_attachments_with_lots_of_spaces_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[email_files_written_outside_of_the_outlook_directory_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[email_servers_sending_high_volume_traffic_to_hosts_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[enable_rdp_in_other_port_number_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[enable_wdigest_uselogoncredential_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[enumerate_users_local_group_using_telegram_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[esentutl_sam_copy_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[eventvwr_uac_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excel_spawning_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excel_spawning_windows_script_host_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_attempt_to_disable_services_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_dns_failures_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_file_deletion_in_windefender_folder_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_service_stop_attempt_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_usage_of_cacls_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_usage_of_net_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_usage_of_sc_service_utility_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_usage_of_taskkill_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_usage_of_nslookup_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_number_of_distinct_processes_created_in_windows_temp_folder_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_number_of_service_control_start_as_disabled_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[excessive_number_of_taskhost_processes_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[exchange_powershell_abuse_via_ssrf_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[exchange_powershell_module_usage_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[executable_file_written_in_administrative_smb_share_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[executables_or_script_creation_in_suspicious_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[execute_javascript_with_jscript_com_clsid_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[execution_of_file_with_spaces_before_extension_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[execution_of_file_with_multiple_extensions_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[extended_period_without_successful_netbackup_backups_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[extraction_of_registry_hives_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[file_with_samsam_extension_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[firewall_allowed_program_enable_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[first_time_seen_child_process_of_zoom_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[first_time_seen_running_windows_service_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[first_time_seen_command_line_argument_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[fodhelper_uac_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[fsutil_zeroing_file_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gcp_detect_accounts_with_high_risk_roles_by_project_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gcp_detect_gcploit_framework_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gcp_detect_high_risk_permissions_by_resource_and_account_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gcp_gcr_container_uploaded_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gcp_kubernetes_activity_by_src_ip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gcp_kubernetes_cluster_pod_scan_detection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gcp_kubernetes_cluster_scan_detection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gpupdate_with_no_command_line_arguments_with_network_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gsuite_email_suspicious_attachment_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gdrive_suspicious_file_sharing_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_addefaultdomainpasswordpolicy_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_aduser_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_aduser_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_aduserresultantpasswordpolicy_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_aduserresultantpasswordpolicy_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_all_aws_activity_from_city_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_all_aws_activity_from_country_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_all_aws_activity_from_ip_address_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_all_aws_activity_from_region_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_backup_logs_for_endpoint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_certificate_logs_for_a_domain_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_dns_server_history_for_a_host_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_dns_traffic_ratio_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_domainpolicy_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_domainpolicy_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_domainuser_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_domainuser_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_ec2_instance_details_by_instanceid_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_ec2_launch_details_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_email_info_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_emails_from_specific_sender_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_first_occurrence_and_last_occurrence_of_a_mac_address_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_history_of_email_sources_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_logon_rights_modifications_for_endpoint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_logon_rights_modifications_for_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_notable_history_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_outbound_emails_to_hidden_cobra_threat_actors_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_parent_process_info_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_process_file_activity_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_process_info_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_process_information_for_port_activity_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_process_responsible_for_the_dns_traffic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_sysmon_wmi_activity_for_host_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_wmiobject_group_discovery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_wmiobject_group_discovery_with_script_block_logging_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_web_session_information_via_session_id_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_domaintrust_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_domaintrust_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_foresttrust_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_foresttrust_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getadcomputer_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getadcomputer_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getadgroup_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getadgroup_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getcurrent_user_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getcurrent_user_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getdomaincomputer_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getdomaincomputer_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getdomaincontroller_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getdomaincontroller_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getdomaingroup_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getdomaingroup_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getlocaluser_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getlocaluser_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getnettcpconnection_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getnettcpconnection_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getwmiobject_ds_user_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getwmiobject_ds_user_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getwmiobject_ds_computer_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getwmiobject_ds_computer_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getwmiobject_ds_group_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getwmiobject_ds_group_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getwmiobject_user_account_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[getwmiobject_user_account_with_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[github_dependabot_alert_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[github_pull_request_from_unknown_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[github_commit_changes_in_master_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[github_commit_in_develop_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gsuite_drive_share_in_external_email_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gsuite_email_suspicious_subject_with_attachment_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gsuite_email_with_known_abuse_web_service_link_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gsuite_outbound_email_with_attachment_to_external_domain_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gsuite_suspicious_shared_file_name_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gsuite_suspicious_calendar_invite_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[hide_user_account_from_sign_in_screen_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[hiding_files_and_directories_with_attrib_exe_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[high_frequency_copy_of_files_in_network_share_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[high_number_of_login_failures_from_a_single_source_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[high_process_termination_frequency_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[hosts_receiving_high_volume_of_network_traffic_from_email_server_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[hunting_for_log4shell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[icacls_grant_command_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[icacls_deny_command_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[icedid_exfiltrated_archived_file_creation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[identify_new_user_accounts_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[identify_systems_creating_remote_desktop_traffic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[identify_systems_receiving_remote_desktop_traffic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[identify_systems_using_remote_desktop_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[impacket_lateral_movement_commandline_parameters_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[interactive_session_on_remote_endpoint_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_aws_user_activities_by_user_field_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_aws_activities_via_region_name_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_failed_logins_for_multiple_destinations_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_network_traffic_from_src_ip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_okta_activity_by_ip_address_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_okta_activity_by_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_pass_the_hash_attempts_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_pass_the_ticket_attempts_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_previous_unseen_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_successful_remote_desktop_authentications_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_suspicious_strings_in_http_header_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_user_activities_in_okta_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_web_posts_from_src_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[java_class_file_download_by_java_user_agent_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[jscript_execution_using_cscript_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kerberoasting_spn_request_with_rc4_encryption_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kerberos_pre_authentication_flag_disabled_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[known_services_killed_by_ransomware_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_aws_detect_rbac_authorization_by_account_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_aws_detect_most_active_service_accounts_by_pod_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_aws_detect_sensitive_role_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_aws_detect_service_accounts_forbidden_failure_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_aws_detect_suspicious_kubectl_calls_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_azure_detect_rbac_authorization_by_account_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_azure_detect_sensitive_object_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_azure_detect_sensitive_role_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_azure_detect_suspicious_kubectl_calls_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_azure_pod_scan_fingerprint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_azure_scan_fingerprint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_gcp_detect_rbac_authorizations_by_account_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_gcp_detect_sensitive_object_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_gcp_detect_sensitive_role_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_gcp_detect_service_accounts_forbidden_failure_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_gcp_detect_suspicious_kubectl_calls_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_nginx_ingress_lfi_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_nginx_ingress_rfi_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[kubernetes_scanner_image_pulling_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[large_volume_of_dns_any_queries_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_add_files_in_known_crontab_directories_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_add_user_account_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_at_allow_config_file_creation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_at_application_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_change_file_owner_to_root_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_common_process_for_elevation_control_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_dd_file_overwrite_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_doas_conf_file_creation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_doas_tool_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_edit_cron_table_parameter_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_file_created_in_kernel_driver_directory_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_file_creation_in_init_boot_directory_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_file_creation_in_profile_directory_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_insert_kernel_module_using_insmod_utility_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_install_kernel_module_using_modprobe_utility_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_java_spawning_shell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_nopasswd_entry_in_sudoers_file_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_possible_access_or_modification_of_sshd_config_file_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_possible_access_to_credential_files_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_possible_access_to_sudoers_file_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_possible_append_command_to_at_allow_config_file_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_possible_append_command_to_profile_config_file_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_possible_cronjob_modification_with_editor_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_possible_ssh_key_file_creation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_preload_hijack_library_calls_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_service_file_created_in_systemd_directory_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_service_restarted_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_service_started_or_enabled_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_setuid_using_chmod_utility_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_setuid_using_setcap_utility_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_sudo_or_su_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_sudoers_tmp_file_creation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_system_network_discovery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_visudo_utility_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[linux_pkexec_privilege_escalation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[loading_of_dynwrapx_module_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[local_account_discovery_with_wmic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[local_account_discovery_with_net_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[log4shell_cve_2021_44228_exploitation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[log4shell_jndi_payload_injection_attempt_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[log4shell_jndi_payload_injection_with_outbound_connection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[logon_script_event_trigger_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ms_scripting_process_loading_ldap_module_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ms_scripting_process_loading_wmi_module_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[msbuild_suspicious_spawned_by_script_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[mshtml_module_load_in_office_product_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[msi_module_loaded_by_non_system_binary_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[macos___re_opened_applications_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[mailsniper_invoke_functions_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[malicious_inprocserver32_modification_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[malicious_powershell_process___encoded_command_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[malicious_powershell_process___execution_policy_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[malicious_powershell_process___multiple_suspicious_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[malicious_powershell_process_with_obfuscation_techniques_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[malicious_powershell_executed_as_a_service_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[microsoft_exchange_mailbox_replication_service_writing_active_server_pages_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[mimikatz_passtheticket_commandline_parameters_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[mmc_lolbas_execution_process_spawn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[modification_of_wallpaper_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[modify_acl_permission_to_files_or_folder_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[monitor_dns_for_brand_abuse_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[monitor_email_for_brand_abuse_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[monitor_registry_keys_for_print_monitors_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[monitor_successful_backups_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[monitor_unsuccessful_backups_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[monitor_web_traffic_for_brand_abuse_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[mshta_spawning_rundll32_or_regsvr32_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[msmpeng_application_dll_side_loading_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_archive_files_http_post_traffic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_users_attempting_to_authenticate_using_explicit_credentials_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_users_failing_to_authenticate_from_host_using_kerberos_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_users_failing_to_authenticate_from_host_using_ntlm_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_users_failing_to_authenticate_from_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[multiple_users_remotely_failing_to_authenticate_from_host_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[net_profiler_uac_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[nltest_domain_trust_discovery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[net_localgroup_discovery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[network_connection_discovery_with_arp_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[network_connection_discovery_with_net_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[network_connection_discovery_with_netstat_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[network_discovery_using_route_windows_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[new_container_uploaded_to_aws_ecr_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[nishang_powershelltcponeline_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[no_windows_updates_in_a_time_frame_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[non_chrome_process_accessing_chrome_default_dir_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[non_firefox_process_access_firefox_profile_dir_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ntdsutil_export_ntds_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_add_app_role_assignment_grant_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_added_service_principal_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_bypass_mfa_via_trusted_ip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_disable_mfa_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_excessive_authentication_failures_alert_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_excessive_sso_logon_errors_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_new_federated_domain_added_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_pst_export_alert_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_suspicious_admin_email_forwarding_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_suspicious_rights_delegation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[o365_suspicious_user_email_forwarding_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_application_drop_executable_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_application_spawn_regsvr32_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_application_spawn_rundll32_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_document_creating_schedule_task_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_document_executing_macro_code_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_document_spawned_child_process_to_download_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_product_spawn_cmd_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_product_spawning_bitsadmin_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_product_spawning_certutil_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_product_spawning_mshta_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_product_spawning_rundll32_with_no_dll_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_product_spawning_wmic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_product_writing_cab_or_inf_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[office_spawning_control_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[okta_account_lockout_events_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[okta_failed_sso_attempts_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[okta_user_logins_from_multiple_cities_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[open_redirect_in_splunk_web_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[osquery_pack___coldroot_detection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[outbound_network_connection_from_java_using_default_ports_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[overwriting_accessibility_binaries_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[password_policy_discovery_with_net_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[permission_modification_using_takeown_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[petitpotam_network_share_access_request_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[petitpotam_suspicious_kerberos_tgt_request_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ping_sleep_batch_command_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[plain_http_post_exfiltrated_data_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[possible_browser_pass_view_parameter_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[possible_lateral_movement_powershell_spawn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[potentially_malicious_code_on_commandline_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell___connect_to_internet_with_hidden_window_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_4104_hunting_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_domain_enumeration_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_get_localgroup_discovery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_start_bitstransfer_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_creating_thread_mutex_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_disable_security_monitoring_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_enable_smb1protocol_feature_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_execute_com_object_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_fileless_process_injection_via_getprocaddress_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_fileless_script_contains_base64_encoded_content_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_get_localgroup_discovery_with_script_block_logging_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_processing_stream_of_data_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_remote_thread_to_known_windows_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_remove_windows_defender_directory_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_using_memory_as_backing_store_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[powershell_windows_defender_exclusion_commands_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[prevent_automatic_repair_mode_using_bcdedit_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_aws_cross_account_activity_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_aws_cross_account_activity___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_aws_cross_account_activity___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_aws_provisioning_activity_sources_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_aws_regions_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_api_calls_per_user_role___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_api_calls_per_user_role___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_creations_by_user___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_creations_by_user___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_images___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_images___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_instance_types___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_instance_types___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_instance_modifications_by_user___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_instance_modifications_by_user___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_provisioning_activity_sources___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_provisioning_activity_sources___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_regions___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_regions___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_ec2_amis_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_ec2_instance_types_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_ec2_launches_by_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_ec2_modifications_by_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_running_windows_services___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_running_windows_services___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_users_in_cloudtrail___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_users_in_cloudtrail___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_zoom_child_processes___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_zoom_child_processes___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_api_call_per_user_roles_in_cloudtrail_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_s3_bucket_access_by_remote_ip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_users_in_cloudtrail_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[print_processor_registry_autostart_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[print_spooler_adding_a_printer_driver_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[print_spooler_failed_to_load_a_plug_in_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[process_creating_lnk_file_in_suspicious_location_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[process_deleting_its_process_file_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[process_execution_via_wmi_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[process_kill_base_on_file_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[process_writing_dynamicwrapperx_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[processes_tapping_keyboard_events_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[processes_created_by_netsh_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[processes_launching_netsh_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[prohibited_network_traffic_allowed_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[prohibited_software_on_endpoint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[protocol_or_port_mismatch_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[protocols_passing_authentication_in_cleartext_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[randomly_generated_scheduled_task_name_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[randomly_generated_windows_service_name_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ransomware_notes_bulk_creation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[recon_avproduct_through_pwh_or_wmi_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[recon_using_wmi_class_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[recursive_delete_of_directory_in_batch_cmd_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[reg_exe_manipulating_windows_services_registry_keys_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[reg_exe_used_to_hide_files_directories_via_registry_keys_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[registry_keys_used_for_persistence_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[registry_keys_used_for_privilege_escalation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[registry_keys_for_creating_shim_databases_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[regsvr32_silent_and_install_param_dll_loading_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[regsvr32_with_known_silent_switch_cmdline_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remcos_rat_file_creation_in_remcos_folder_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remcos_client_registry_install_entry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_desktop_network_bruteforce_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_desktop_network_traffic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_desktop_process_running_on_system_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_process_instantiation_via_dcom_and_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_process_instantiation_via_dcom_and_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_process_instantiation_via_wmi_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_process_instantiation_via_wmi_and_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_process_instantiation_via_wmi_and_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_process_instantiation_via_winrm_and_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_process_instantiation_via_winrm_and_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_process_instantiation_via_winrm_and_winrs_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_registry_key_modifications_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_system_discovery_with_adsisearcher_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_system_discovery_with_dsquery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_system_discovery_with_net_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_system_discovery_with_wmic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[remote_wmi_command_attempt_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[resize_shadowstorage_volume_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[revil_common_exec_parameter_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[revil_registry_entry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rubeus_command_line_parameters_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rubeus_kerberos_ticket_exports_through_winlogon_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rundll_loading_dll_by_ordinal_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[runas_execution_in_commandline_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rundll32_control_rundll_hunt_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rundll32_control_rundll_world_writable_directory_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rundll32_create_remote_thread_to_a_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rundll32_createremotethread_in_browser_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rundll32_dnsquery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rundll32_lockworkstation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rundll32_process_creating_exe_dll_files_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rundll32_shimcache_flush_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[rundll32_with_no_command_line_arguments_with_network_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ryuk_test_files_detected_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[ryuk_wake_on_lan_command_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[sam_database_file_access_attempt_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[slui_runas_elevated_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[slui_spawning_a_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[smb_traffic_spike_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[smb_traffic_spike___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[sql_injection_with_long_urls_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[samsam_test_file_write_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[sc_exe_manipulating_windows_services_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[schcache_change_by_app_connect_and_create_adsi_object_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[schedule_task_with_http_command_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[schedule_task_with_rundll32_command_trigger_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[scheduled_task_creation_on_remote_endpoint_using_at_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[scheduled_task_deleted_or_created_via_cmd_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[scheduled_task_initiation_on_remote_endpoint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[scheduled_tasks_used_in_badrabbit_ransomware_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[schtasks_run_task_on_demand_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[schtasks_scheduling_job_on_remote_system_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[schtasks_used_for_forcing_a_reboot_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[screensaver_event_trigger_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[script_execution_via_wmi_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[sdclt_uac_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[sdelete_application_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[searchprotocolhost_with_no_command_line_with_network_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[secretdumps_offline_ntds_dumping_tool_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[serviceprincipalnames_discovery_with_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[serviceprincipalnames_discovery_with_setspn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[services_escalate_exe_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[services_lolbas_execution_process_spawn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[shim_database_file_creation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[shim_database_installation_with_suspicious_parameters_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[short_lived_scheduled_task_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[short_lived_windows_accounts_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[silentcleanup_uac_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[single_letter_process_on_endpoint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[spectre_and_meltdown_vulnerable_systems_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[spike_in_file_writes_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[splunk_enterprise_information_disclosure_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[spoolsv_spawning_rundll32_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[spoolsv_suspicious_loaded_modules_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[spoolsv_suspicious_process_access_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[spoolsv_writing_a_dll_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[spoolsv_writing_a_dll___sysmon_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[sqlite_module_in_temp_folder_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[start_up_during_safe_mode_boot_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[sunburst_correlation_dll_and_network_event_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[supernova_webshell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_changes_to_file_associations_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_computer_account_name_change_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_copy_on_system32_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_curl_network_connection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_dllhost_no_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_driver_loaded_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_email___uba_anomaly_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_email_attachment_extensions_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_event_log_service_behavior_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_file_write_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_gpupdate_no_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_icedid_rundll32_cmdline_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_image_creation_in_appdata_folder_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_java_classes_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_kerberos_service_ticket_request_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_linux_discovery_commands_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_msbuild_rename_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_msbuild_spawn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_plistbuddy_usage_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_plistbuddy_usage_via_osquery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_process_dns_query_known_abuse_web_services_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_process_file_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_process_with_discord_dns_query_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_reg_exe_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_regsvr32_register_suspicious_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_rundll32_plugininit_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_rundll32_rename_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_rundll32_startw_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_rundll32_dllregisterserver_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_rundll32_no_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_sqlite3_lsquarantine_behavior_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_scheduled_task_from_public_directory_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_searchprotocolhost_no_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_ticket_granting_ticket_request_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_wav_file_in_appdata_folder_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_microsoft_workflow_compiler_rename_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_microsoft_workflow_compiler_usage_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_msbuild_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_mshta_child_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_mshta_spawn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_wevtutil_usage_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_writes_to_system_volume_information_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[suspicious_writes_to_windows_recycle_bin_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[svchost_lolbas_execution_process_spawn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[system_info_gathering_using_dxdiag_application_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[system_information_discovery_detection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[system_processes_run_from_unexpected_locations_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[system_user_discovery_with_query_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[system_user_discovery_with_whoami_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[systems_ready_for_spectre_meltdown_windows_patch_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[tor_traffic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[time_provider_persistence_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[trickbot_named_pipe_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[uac_bypass_mmc_load_unsigned_dll_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[uac_bypass_with_colorui_com_object_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[usn_journal_deletion_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[uncommon_processes_on_endpoint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[unified_messaging_service_spawning_a_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[uninstall_app_using_msiexec_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[unload_sysmon_filter_driver_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[unloading_amsi_via_reflection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[unsigned_image_loaded_by_lsass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[unsuccessful_netbackup_backups_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[unusual_number_of_computer_service_tickets_requested_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[unusual_number_of_kerberos_service_tickets_requested_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[unusual_number_of_remote_endpoint_authentication_events_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[unusually_long_command_line_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[unusually_long_command_line___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[unusually_long_content_type_length_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[update_previously_seen_users_in_cloudtrail_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[user_discovery_with_env_vars_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[user_discovery_with_env_vars_powershell_script_block_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[vbscript_execution_using_wscript_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[verclsid_clsid_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[w3wp_spawning_shell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wbadmin_delete_system_backups_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wmi_permanent_event_subscription_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wmi_permanent_event_subscription___sysmon_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wmi_recon_running_process_or_services_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wmi_temporary_event_subscription_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wmic_xsl_execution_via_url_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wsreset_uac_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wbemprox_com_object_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[web_fraud___account_harvesting_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[web_fraud___anomalous_user_clickspeed_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[web_fraud___password_sharing_across_accounts_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[web_servers_executing_suspicious_processes_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wermgr_process_connecting_to_ip_check_web_services_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wermgr_process_create_executable_file_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wermgr_process_spawned_cmd_or_powershell_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wget_download_and_bash_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[winevent_scheduled_task_created_within_public_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[winevent_scheduled_task_created_to_spawn_shell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[winevent_windows_task_scheduler_event_action_started_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[winrm_spawning_a_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_adfind_exe_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_curl_download_to_suspicious_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_curl_upload_to_remote_destination_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_dism_remove_defender_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_defender_exclusion_registry_entry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_disable_memory_crash_dump_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_disableantispyware_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_diskcryptor_usage_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_diskshadow_proxy_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_dotnet_binary_in_non_standard_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_event_for_service_disabled_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_event_log_cleared_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_excessive_disabled_services_event_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_file_without_extension_in_critical_folder_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_high_file_deletion_frequency_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_hunting_system_account_targeting_lsass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_indirect_command_execution_via_forfiles_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_indirect_command_execution_via_pcalua_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_installutil_credential_theft_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_installutil_remote_network_connection_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_installutil_url_in_command_line_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_installutil_uninstall_option_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_installutil_uninstall_option_with_network_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_installutil_in_non_standard_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_java_spawning_shells_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_modify_show_compress_color_and_info_tip_registry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_nirsoft_advancedrun_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_nirsoft_utilities_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_non_system_account_targeting_lsass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_possible_credential_dumping_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_process_with_namedpipe_commandline_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_raccine_scheduled_task_deletion_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_rasautou_dll_execution_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_raw_access_to_disk_volume_partition_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_raw_access_to_master_boot_record_drive_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_remote_assistance_spawning_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_schtasks_create_run_as_system_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_security_account_manager_stopped_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_service_created_with_suspicious_service_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_service_created_within_public_path_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_service_creation_using_registry_entry_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_service_creation_on_remote_endpoint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_service_initiation_on_remote_endpoint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_updates_install_failures_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_updates_install_successes_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_wmi_process_call_create_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_connhost_exe_started_forcefully_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_hosts_file_modification_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[winhlp32_spawning_a_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[winword_spawning_cmd_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[winword_spawning_powershell_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[winword_spawning_windows_script_host_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wmic_group_discovery_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wmic_noninteractive_app_uninstallation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wmiprsve_lolbas_execution_process_spawn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wscript_or_cscript_suspicious_child_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[wsmprovhost_lolbas_execution_process_spawn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[xmrig_driver_loaded_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[xsl_script_execution_with_wmic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_detect_attach_to_role_policy_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_detect_permanent_key_creation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_detect_role_creation_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_detect_sts_assume_role_abuse_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_detect_sts_get_session_token_abuse_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[gcp_detect_oauth_token_abuse_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. +