From 98f83c7469946c0d895e839551404da2061937e0 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 4 Mar 2022 17:13:18 -0800
Subject: [PATCH 01/20] First commit of initial detection work. Skeleton
 detection is good, but may need more details.  Still need to work on
 documentation in detection yaml file and uploading the dataset

---
 .../windows_indirect_command_execution.yml    | 87 +++++++++++++++++++
 dist/escu/default/macros.conf                 |  4 +
 macros/common_windows_binary_paths.yml        |  4 +
 ...indows_indirect_command_execution.test.yml | 15 ++++
 4 files changed, 110 insertions(+)
 create mode 100644 detections/endpoint/windows_indirect_command_execution.yml
 create mode 100644 macros/common_windows_binary_paths.yml
 create mode 100644 tests/endpoint/windows_indirect_command_execution.test.yml

diff --git a/detections/endpoint/windows_indirect_command_execution.yml b/detections/endpoint/windows_indirect_command_execution.yml
new file mode 100644
index 0000000000..02944cab16
--- /dev/null
+++ b/detections/endpoint/windows_indirect_command_execution.yml
@@ -0,0 +1,87 @@
+name: Windows T1202 Indirect Command Execution
+id: 59e54602-9680-11ec-a8a6-acde48001122
+version: 1
+date: '2022-03-04'
+author: Eric McGinnis, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following analytic detection programs that have been started by pcalua.exe, forfiles, forfiles.exe, or conhost.exe.  
+  While these tools can be used to start legitimate programs, they have been observed being evade protections on command line execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+    as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name IN ("forfiles.exe", "pcalua.exe") AND NOT (`common_windows_binary_paths`) 
+    by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_path
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `windows_indirect_command_execution_file`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the full process path in the process field of CIM's Process data model.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+  Tune and filter known instances where renamed forfiles.exe and pcalua.exe may be used.
+known_false_positives: Some legacy applications may be run using pcalua.exe.  
+  Similarly, forfiles.exe may be used in legitimate batch scripts.  Filter these results as needed.  
+references:
+  - REF1
+  - REF2 - NOTHING BELOW HERE HAS BEEN MODIFIED YET
+tags:
+  analytic_story:
+  - Data Destruction
+  - Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1485
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.file_create_time 
+  - Filesystem.process_id 
+  - Filesystem.file_name 
+  - Filesystem.user 
+  - Filesystem.file_path 
+  - Filesystem.dest
+  - Processes.process_id 
+  - Processes.process_name
+  - Processes.process 
+  - Processes.dest 
+  - Processes.parent_process_name 
+  - Processes.parent_process
+  - Processes.process_guid
+  security_domain: endpoint
+  impact: 90
+  confidence: 100 
+  # (impact * confidence)/100
+  risk_score: 90
+  context: 
+  - Source:Endpoint
+  - Stage:Persistence
+  - Privilege Escalation
+  message: A process $process_name$ was identified attempting to disable memory crash dumps on $dest$.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  nist:
+  - DE.CM
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16 
\ No newline at end of file
diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf
index 4a217aac16..3642c0a1f1 100644
--- a/dist/escu/default/macros.conf
+++ b/dist/escu/default/macros.conf
@@ -4099,6 +4099,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[windows_indirect_command_execution]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [windows_installutil_credential_theft_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
diff --git a/macros/common_windows_binary_paths.yml b/macros/common_windows_binary_paths.yml
new file mode 100644
index 0000000000..6460886724
--- /dev/null
+++ b/macros/common_windows_binary_paths.yml
@@ -0,0 +1,4 @@
+definition: Processes.process_path="C:\\Windows*" OR Processes.process_path="C:\\Program Files*") 
+description: A list of common Windows directories where binaries maybe found.
+  These binaries could be Windows System Binaries or user-installed binaries
+name: common_windows_binary_paths
\ No newline at end of file
diff --git a/tests/endpoint/windows_indirect_command_execution.test.yml b/tests/endpoint/windows_indirect_command_execution.test.yml
new file mode 100644
index 0000000000..2d7f88e4d8
--- /dev/null
+++ b/tests/endpoint/windows_indirect_command_execution.test.yml
@@ -0,0 +1,15 @@
+name: Windows Indirect Command Execution Unit Test
+tests:
+- name: Windows Indirect Command Excecution
+  file: endpoint/windows_indirect_command_execution.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: DOES_NOT_EXIST.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/DOES/NOT/EXIST/DATASET.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+
+
+    
\ No newline at end of file

From 44ba1a020122d38bef70bd9c1442f1baa7221a77 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 4 Mar 2022 17:29:52 -0800
Subject: [PATCH 02/20] Updating to a unique uuid

---
 detections/endpoint/windows_indirect_command_execution.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_indirect_command_execution.yml b/detections/endpoint/windows_indirect_command_execution.yml
index 02944cab16..f34a3e3503 100644
--- a/detections/endpoint/windows_indirect_command_execution.yml
+++ b/detections/endpoint/windows_indirect_command_execution.yml
@@ -1,5 +1,5 @@
 name: Windows T1202 Indirect Command Execution
-id: 59e54602-9680-11ec-a8a6-acde48001122
+id: 59e54602-9680-11ec-a8a6-aaaaaaaaaaaa
 version: 1
 date: '2022-03-04'
 author: Eric McGinnis, Splunk

From d63cffe88385eb1fab5348a1499cae7cd5d6d1f4 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 11 Mar 2022 18:09:09 -0800
Subject: [PATCH 03/20] Updated name of detection and test files. Updated path
 for data file, which has not been uploaded yet.  Updated most of the fields
 in the detection.

---
 ...indirect_command_execution_via_pcalua.yml} | 71 +++++++------------
 macros/common_windows_binary_paths.yml        |  4 --
 ...ect_command_execution_via_pcalua.test.yml} |  9 +--
 3 files changed, 30 insertions(+), 54 deletions(-)
 rename detections/endpoint/{windows_indirect_command_execution.yml => windows_indirect_command_execution_via_pcalua.yml} (62%)
 delete mode 100644 macros/common_windows_binary_paths.yml
 rename tests/endpoint/{windows_indirect_command_execution.test.yml => windows_indirect_command_execution_via_pcalua.test.yml} (75%)

diff --git a/detections/endpoint/windows_indirect_command_execution.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
similarity index 62%
rename from detections/endpoint/windows_indirect_command_execution.yml
rename to detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
index f34a3e3503..9b6b10346c 100644
--- a/detections/endpoint/windows_indirect_command_execution.yml
+++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
@@ -1,15 +1,15 @@
-name: Windows T1202 Indirect Command Execution
+name: Windows Indirect Command Execution Via pcalua
 id: 59e54602-9680-11ec-a8a6-aaaaaaaaaaaa
 version: 1
-date: '2022-03-04'
+date: '2022-03-09'
 author: Eric McGinnis, Splunk
-type: Hunting
+type: TTP
 datamodel:
 - Endpoint
 description: The following analytic detection programs that have been started by pcalua.exe, forfiles, forfiles.exe, or conhost.exe.  
   While these tools can be used to start legitimate programs, they have been observed being evade protections on command line execution.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name IN ("forfiles.exe", "pcalua.exe") AND NOT (`common_windows_binary_paths`) 
+    as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="pcalua.exe" 
     by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_path
   | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -21,67 +21,50 @@ how_to_implement: To successfully implement this search, you need to be ingestin
 known_false_positives: Some legacy applications may be run using pcalua.exe.  
   Similarly, forfiles.exe may be used in legitimate batch scripts.  Filter these results as needed.  
 references:
-  - REF1
-  - REF2 - NOTHING BELOW HERE HAS BEEN MODIFIED YET
+  - https://twitter.com/KyleHanslovan/status/912659279806640128
+  - REF2 - FIND ANOTHER REFERENCE
 tags:
   analytic_story:
-  - Data Destruction
-  - Ransomware
+  - Living Off The Land
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
-  - T1485
+  - T1202
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
   - _time
-  - Filesystem.file_create_time 
-  - Filesystem.process_id 
-  - Filesystem.file_name 
-  - Filesystem.user 
-  - Filesystem.file_path 
-  - Filesystem.dest
-  - Processes.process_id 
-  - Processes.process_name
-  - Processes.process 
-  - Processes.dest 
-  - Processes.parent_process_name 
-  - Processes.parent_process
-  - Processes.process_guid
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.user
+  - Endpoint.Processes.dest 
+  - Endpoint.Processes.user 
+  - Endpoint.Processes.parent_process 
+  - Endpoint.Processes.parent_process_name 
+  - Endpoint.Processes.process_name 
+  - Endpoint.Processes.process 
+  - Endpoint.Processes.process_id 
+  - Endpoint.Processes.parent_process_id 
+  - Endpoint.Processes.process_path
   security_domain: endpoint
-  impact: 90
-  confidence: 100 
+  impact: 50
+  confidence: 50 
   # (impact * confidence)/100
-  risk_score: 90
+  risk_score: 50
   context: 
   - Source:Endpoint
-  - Stage:Persistence
-  - Privilege Escalation
-  message: A process $process_name$ was identified attempting to disable memory crash dumps on $dest$.
+  - Stage:Defense Evasion
+  message: The Program Compatability Assistant (pcalua.exe) launched the process $process_name$
   observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Parent Process
-    role:
-    - Parent Process
   - name: process_name
     type: Process
     role:
     - Child Process
   nist:
-  - DE.CM
+  - DE.AE
   cis20:
-  - CIS 3
-  - CIS 5
-  - CIS 16 
\ No newline at end of file
+  - CIS 8
+  - CIS 10 
\ No newline at end of file
diff --git a/macros/common_windows_binary_paths.yml b/macros/common_windows_binary_paths.yml
deleted file mode 100644
index 6460886724..0000000000
--- a/macros/common_windows_binary_paths.yml
+++ /dev/null
@@ -1,4 +0,0 @@
-definition: Processes.process_path="C:\\Windows*" OR Processes.process_path="C:\\Program Files*") 
-description: A list of common Windows directories where binaries maybe found.
-  These binaries could be Windows System Binaries or user-installed binaries
-name: common_windows_binary_paths
\ No newline at end of file
diff --git a/tests/endpoint/windows_indirect_command_execution.test.yml b/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml
similarity index 75%
rename from tests/endpoint/windows_indirect_command_execution.test.yml
rename to tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml
index 2d7f88e4d8..ee599b6c99 100644
--- a/tests/endpoint/windows_indirect_command_execution.test.yml
+++ b/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml
@@ -6,10 +6,7 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: DOES_NOT_EXIST.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/DOES/NOT/EXIST/DATASET.log
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/T1202/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
-
-
-    
\ No newline at end of file
+    sourcetype: xmlwineventlog
\ No newline at end of file

From aa177fdb1c3849c28e646d625a05e303be598e46 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 25 Mar 2022 12:45:36 -0700
Subject: [PATCH 04/20] Updated detections for pcalua and forfiles.

---
 ...ndirect_command_execution_via_forfiles.yml | 70 +++++++++++++++++++
 ..._indirect_command_execution_via_pcalua.yml |  4 +-
 ...ct_command_execution_via_forfiles.test.yml | 12 ++++
 ...rect_command_execution_via_pcalua.test.yml |  4 +-
 4 files changed, 86 insertions(+), 4 deletions(-)
 create mode 100644 detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
 create mode 100644 tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml

diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
new file mode 100644
index 0000000000..9cd2a9c615
--- /dev/null
+++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
@@ -0,0 +1,70 @@
+name: Windows Indirect Command Execution Via forfiles
+id: 59e54602-9680-11ec-a8a6-aaaaaaaaaaaa
+version: 1
+date: '2022-03-09'
+author: Eric McGinnis, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic detection programs that have been started by pcalua.exe, forfiles, forfiles.exe, or conhost.exe.  
+  While these tools can be used to start legitimate programs, they have been observed being evade protections on command line execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+    as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*forfiles* /c *"  
+    by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_path
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `windows_indirect_command_execution_via_forfiles_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the full process path in the process field of CIM's Process data model.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+  Tune and filter known instances where renamed forfiles.exe and pcalua.exe may be used.
+known_false_positives: Some legacy applications may be run using pcalua.exe.  
+  Similarly, forfiles.exe may be used in legitimate batch scripts.  Filter these results as needed.  
+references:
+  - https://twitter.com/KyleHanslovan/status/912659279806640128
+  - REF2 - FIND ANOTHER REFERENCE
+tags:
+  analytic_story:
+  - Living Off The Land
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1202
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.user
+  - Endpoint.Processes.dest 
+  - Endpoint.Processes.user 
+  - Endpoint.Processes.parent_process 
+  - Endpoint.Processes.parent_process_name 
+  - Endpoint.Processes.process_name 
+  - Endpoint.Processes.process 
+  - Endpoint.Processes.process_id 
+  - Endpoint.Processes.parent_process_id 
+  - Endpoint.Processes.process_path
+  security_domain: endpoint
+  impact: 50
+  confidence: 50 
+  # (impact * confidence)/100
+  risk_score: 50
+  context: 
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: The Program Compatability Assistant (pcalua.exe) launched the process $process_name$
+  observable:
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  nist:
+  - DE.AE
+  cis20:
+  - CIS 8
+  - CIS 10 
\ No newline at end of file
diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
index 9b6b10346c..baeba46177 100644
--- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
+++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
@@ -9,11 +9,11 @@ datamodel:
 description: The following analytic detection programs that have been started by pcalua.exe, forfiles, forfiles.exe, or conhost.exe.  
   While these tools can be used to start legitimate programs, they have been observed being evade protections on command line execution.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-    as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="pcalua.exe" 
+    as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*pcalua* -a*"  
     by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_path
   | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `windows_indirect_command_execution_file`'
+  | `windows_indirect_command_execution_via_pcaluafilter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the full process path in the process field of CIM's Process data model.
   If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
diff --git a/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml b/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml
new file mode 100644
index 0000000000..c5cd2548ea
--- /dev/null
+++ b/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml
@@ -0,0 +1,12 @@
+name: Windows Indirect Command Execution via forfiles Unit Test
+tests:
+- name: Windows Indirect Command Excecution via forfiles
+  file: endpoint/windows_indirect_command_execution.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/T1202/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml b/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml
index ee599b6c99..1465a8a32a 100644
--- a/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml
+++ b/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml
@@ -1,6 +1,6 @@
-name: Windows Indirect Command Execution Unit Test
+name: Windows Indirect Command Execution Via pcalua Unit Test
 tests:
-- name: Windows Indirect Command Excecution
+- name: Windows Indirect Command Excecution via pcalua
   file: endpoint/windows_indirect_command_execution.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'

From db61bb0c56f38da5b22de00832870ffc8dc6bd76 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 25 Mar 2022 12:54:57 -0700
Subject: [PATCH 05/20] Changes paths to data since it is in an open PR

---
 .../windows_indirect_command_execution_via_forfiles.test.yml    | 2 +-
 .../windows_indirect_command_execution_via_pcalua.test.yml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml b/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml
index c5cd2548ea..0cb28311cf 100644
--- a/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml
+++ b/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml
@@ -7,6 +7,6 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/T1202/atomic_red_team/windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/InDirectToVideoData/master/datasets/T1202/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml b/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml
index 1465a8a32a..d8a12ad6bd 100644
--- a/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml
+++ b/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml
@@ -7,6 +7,6 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/T1202/atomic_red_team/windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/InDirectToVideoData/datasets/T1202/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
\ No newline at end of file

From 2af5a8f2680e50a83b6c5bd41a2b98cc8df7b0bb Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 25 Mar 2022 13:05:26 -0700
Subject: [PATCH 06/20] Removed manual changes to filter macro macros.conf file

---
 dist/escu/default/macros.conf | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf
index 3642c0a1f1..4a217aac16 100644
--- a/dist/escu/default/macros.conf
+++ b/dist/escu/default/macros.conf
@@ -4099,10 +4099,6 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
-[windows_indirect_command_execution]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
 [windows_installutil_credential_theft_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 

From 9e2e09a168f7ae9bd98a34a101dc7bc508b6fded Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 25 Mar 2022 13:26:16 -0700
Subject: [PATCH 07/20] Added filter macro

---
 ..._indirect_command_execution_via_pcalua.yml |    2 +-
 dist/escu/default/macros.conf                 | 7086 +++++++++--------
 2 files changed, 3750 insertions(+), 3338 deletions(-)

diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
index baeba46177..608929175e 100644
--- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
+++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
@@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
     by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_path
   | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `windows_indirect_command_execution_via_pcaluafilter`'
+  | `windows_indirect_command_execution_via_pcalua_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the full process path in the process field of CIM's Process data model.
   If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf
index 599b52e09d..3d3cf545f9 100644
--- a/dist/escu/default/macros.conf
+++ b/dist/escu/default/macros.conf
@@ -1,3342 +1,10 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-24T08:24:11 UTC
+# On Date: 2022-03-03T18:16:55 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
 
-[abnormally_high_number_of_cloud_infrastructure_api_calls_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[abnormally_high_number_of_cloud_security_group_api_calls_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_create_policy_version_to_allow_all_resources_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_createaccesskey_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_createloginprofile_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_cross_account_activity_from_previously_unseen_account_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_detect_users_with_kms_keys_performing_encryption_s3_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_ecr_container_scanning_findings_high_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_ecr_container_scanning_findings_low_informational_unknown_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_ecr_container_scanning_findings_medium_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_ecr_container_upload_outside_business_hours_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_ecr_container_upload_unknown_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_excessive_security_scanning_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_iam_accessdenied_discovery_events_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_iam_assume_role_policy_brute_force_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_iam_delete_policy_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_iam_failure_group_deletion_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_iam_successful_group_deletion_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_lambda_updatefunctioncode_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_network_access_control_list_created_with_all_open_ports_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_network_access_control_list_deleted_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_saml_access_by_provider_user_and_principal_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_saml_update_identity_provider_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_setdefaultpolicyversion_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_updateloginprofile_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[circle_ci_disable_security_job_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[circle_ci_disable_security_step_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[cloud_api_calls_from_previously_unseen_user_roles_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[cloud_compute_instance_created_by_previously_unseen_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[cloud_compute_instance_created_in_previously_unused_region_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[cloud_compute_instance_created_with_previously_unseen_image_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[cloud_compute_instance_created_with_previously_unseen_instance_type_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[cloud_instance_modified_by_previously_unseen_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[cloud_provisioning_activity_from_previously_unseen_city_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[cloud_provisioning_activity_from_previously_unseen_country_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[cloud_provisioning_activity_from_previously_unseen_ip_address_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[cloud_provisioning_activity_from_previously_unseen_region_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[correlation_by_repository_and_risk_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[correlation_by_user_and_risk_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_aws_console_login_by_new_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_aws_console_login_by_user_from_new_city_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_aws_console_login_by_user_from_new_country_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_aws_console_login_by_user_from_new_region_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_new_open_s3_buckets_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_new_open_s3_buckets_over_aws_cli_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_shared_ec2_snapshot_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[github_commit_changes_in_master_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[github_commit_in_develop_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[github_dependabot_alert_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[github_pull_request_from_unknown_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[gsuite_drive_share_in_external_email_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[gsuite_email_suspicious_attachment_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[gsuite_email_suspicious_subject_with_attachment_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[gsuite_email_with_known_abuse_web_service_link_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[gsuite_outbound_email_with_attachment_to_external_domain_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[gsuite_suspicious_shared_file_name_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kubernetes_nginx_ingress_lfi_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kubernetes_nginx_ingress_rfi_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kubernetes_scanner_image_pulling_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[o365_add_app_role_assignment_grant_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[o365_added_service_principal_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[o365_bypass_mfa_via_trusted_ip_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[o365_disable_mfa_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[o365_excessive_authentication_failures_alert_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[o365_excessive_sso_logon_errors_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[o365_new_federated_domain_added_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[o365_pst_export_alert_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[o365_suspicious_admin_email_forwarding_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[o365_suspicious_rights_delegation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[o365_suspicious_user_email_forwarding_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[abnormally_high_aws_instances_launched_by_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[abnormally_high_aws_instances_launched_by_user___mltk_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[abnormally_high_aws_instances_terminated_by_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[abnormally_high_aws_instances_terminated_by_user___mltk_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_cloud_provisioning_from_previously_unseen_city_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_cloud_provisioning_from_previously_unseen_country_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_cloud_provisioning_from_previously_unseen_ip_address_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_cloud_provisioning_from_previously_unseen_region_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[clients_connecting_to_multiple_dns_servers_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[cloud_network_access_control_list_deleted_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_api_activity_from_users_without_mfa_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_aws_api_activities_from_unapproved_accounts_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_long_dns_txt_record_response_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_mimikatz_via_powershell_and_eventcode_4703_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_new_api_calls_from_user_roles_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_new_user_aws_console_login_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_spike_in_aws_api_activity_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_spike_in_network_acl_activity_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_spike_in_security_group_activity_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_usb_device_insertion_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_web_traffic_to_dynamic_domain_providers_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detection_of_dns_tunnels_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[dns_query_requests_resolved_by_unauthorized_dns_servers_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[dns_record_changed_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[dump_lsass_via_procdump_rename_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[ec2_instance_modified_with_previously_unseen_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[ec2_instance_started_in_previously_unseen_region_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[ec2_instance_started_with_previously_unseen_ami_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[ec2_instance_started_with_previously_unseen_instance_type_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[ec2_instance_started_with_previously_unseen_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[execution_of_file_with_spaces_before_extension_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[extended_period_without_successful_netbackup_backups_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[first_time_seen_command_line_argument_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[gcp_detect_accounts_with_high_risk_roles_by_project_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[gcp_detect_high_risk_permissions_by_resource_and_account_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[gcp_detect_oauth_token_abuse_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[gcp_gcr_container_uploaded_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[gcp_kubernetes_cluster_scan_detection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[identify_new_user_accounts_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kubernetes_aws_detect_most_active_service_accounts_by_pod_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kubernetes_aws_detect_rbac_authorization_by_account_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_eks_kubernetes_cluster_sensitive_object_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kubernetes_aws_detect_sensitive_role_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kubernetes_aws_detect_service_accounts_forbidden_failure_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kubernetes_azure_active_service_accounts_by_pod_namespace_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kubernetes_azure_detect_rbac_authorization_by_account_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kubernetes_azure_detect_sensitive_object_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kubernetes_azure_detect_sensitive_role_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kubernetes_azure_detect_suspicious_kubectl_calls_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kubernetes_azure_pod_scan_fingerprint_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kubernetes_azure_scan_fingerprint_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kubernetes_gcp_detect_rbac_authorizations_by_account_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kubernetes_gcp_detect_sensitive_object_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kubernetes_gcp_detect_sensitive_role_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kubernetes_gcp_detect_service_accounts_forbidden_failure_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kubernetes_gcp_detect_suspicious_kubectl_calls_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[monitor_dns_for_brand_abuse_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[open_redirect_in_splunk_web_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[osquery_pack___coldroot_detection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[processes_created_by_netsh_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[prohibited_software_on_endpoint_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[reg_exe_used_to_hide_files_directories_via_registry_keys_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[remote_registry_key_modifications_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[scheduled_tasks_used_in_badrabbit_ransomware_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[spectre_and_meltdown_vulnerable_systems_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[splunk_enterprise_information_disclosure_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_changes_to_file_associations_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_email___uba_anomaly_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_file_write_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_powershell_command_line_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_rundll32_rename_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_writes_to_system_volume_information_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[uncommon_processes_on_endpoint_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[unsigned_image_loaded_by_lsass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[unsuccessful_netbackup_backups_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[web_fraud___account_harvesting_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[web_fraud___anomalous_user_clickspeed_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[web_fraud___password_sharing_across_accounts_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_connhost_exe_started_forcefully_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_hosts_file_modification_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[7zip_commandline_to_smb_share_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[access_lsass_memory_for_dump_creation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[account_discovery_with_net_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[active_setup_registry_autostart_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[add_defaultuser_and_password_in_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[add_or_set_windows_defender_exclusion_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[adsisearcher_account_discovery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[allow_file_and_printing_sharing_in_firewall_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[allow_inbound_traffic_by_firewall_rule_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[allow_inbound_traffic_in_firewall_rule_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[allow_network_discovery_in_firewall_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[allow_operation_with_consent_admin_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[anomalous_usage_of_7zip_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[any_powershell_downloadfile_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[any_powershell_downloadstring_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[attacker_tools_on_endpoint_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[attempt_to_add_certificate_to_untrusted_store_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[attempt_to_stop_security_service_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[attempted_credential_dump_from_registry_via_reg_exe_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[auto_admin_logon_registry_entry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[batch_file_write_to_system32_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[bcdedit_command_back_to_normal_mode_boot_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[bcdedit_failure_recovery_modification_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[bits_job_persistence_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[bitsadmin_download_file_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[certutil_download_with_urlcache_and_split_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[certutil_download_with_verifyctl_and_split_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[certutil_exe_certificate_extraction_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[certutil_with_decode_argument_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[change_default_file_association_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[change_to_safe_mode_with_network_config_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[chcp_command_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[check_elevated_cmd_using_whoami_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[clear_unallocated_sector_using_cipher_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[clop_common_exec_parameter_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[clop_ransomware_known_service_name_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[cmd_carry_out_string_command_parameter_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[cmd_echo_pipe___escalation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[cmdline_tool_not_executed_in_cmd_shell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[cmlua_or_cmstplua_uac_bypass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[cobalt_strike_named_pipes_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[common_ransomware_extensions_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[common_ransomware_notes_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[conti_common_exec_parameter_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[control_loading_from_world_writable_directory_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[create_local_admin_accounts_using_net_exe_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[create_or_delete_windows_shares_using_net_exe_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[create_remote_thread_in_shell_application_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[create_remote_thread_into_lsass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[creation_of_lsass_dump_with_taskmgr_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[creation_of_shadow_copy_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[creation_of_shadow_copy_with_wmic_and_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[credential_dumping_via_copy_command_from_shadow_copy_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[credential_dumping_via_symlink_to_shadow_copy_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[csc_net_on_the_fly_compilation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[curl_download_and_bash_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[delete_shadowcopy_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[deleting_of_net_users_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[deleting_shadow_copies_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_activity_related_to_pass_the_hash_attacks_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_azurehound_command_line_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_azurehound_file_modifications_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_copy_of_shadowcopy_with_script_block_logging_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_credential_dumping_through_lsass_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_empire_with_powershell_script_block_logging_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_excessive_account_lockouts_from_endpoint_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_excessive_user_account_lockouts_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_exchange_web_shell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_html_help_renamed_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_html_help_spawn_child_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_html_help_url_in_command_line_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_html_help_using_infotech_storage_handlers_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_mimikatz_using_loaded_images_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_mimikatz_with_powershell_script_block_logging_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_mshta_inline_hta_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_mshta_renamed_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_mshta_url_in_command_line_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_new_local_admin_account_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_path_interception_by_creation_of_program_exe_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_processes_used_for_system_network_configuration_discovery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_prohibited_applications_spawning_cmd_exe_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_psexec_with_accepteula_flag_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_rclone_command_line_usage_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_regasm_spawning_a_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_regasm_with_network_connection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_regasm_with_no_command_line_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_regsvcs_spawning_a_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_regsvcs_with_network_connection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_regsvcs_with_no_command_line_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_regsvr32_application_control_bypass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_renamed_7_zip_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_renamed_psexec_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_renamed_rclone_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_renamed_winrar_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_rundll32_application_control_bypass___advpack_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_rundll32_application_control_bypass___setupapi_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_rundll32_application_control_bypass___syssetup_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_rundll32_inline_hta_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_sharphound_command_line_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_sharphound_file_modifications_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_sharphound_usage_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_use_of_cmd_exe_to_launch_script_interpreters_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_wmi_event_subscription_persistence_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disable_amsi_through_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disable_defender_antivirus_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disable_defender_blockatfirstseen_feature_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disable_defender_enhanced_notification_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disable_defender_mpengine_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disable_defender_spynet_reporting_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disable_defender_submit_samples_consent_feature_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disable_etw_through_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disable_logs_using_wevtutil_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disable_registry_tool_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disable_schedule_task_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disable_security_logs_using_minint_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disable_show_hidden_files_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disable_uac_remote_restriction_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disable_windows_app_hotkeys_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disable_windows_behavior_monitoring_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disable_windows_smartscreen_protection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disabled_kerberos_pre_authentication_discovery_with_powerview_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disabling_cmd_application_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disabling_controlpanel_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disabling_defender_services_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disabling_firewall_with_netsh_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disabling_folderoptions_windows_feature_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disabling_net_user_account_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disabling_norun_windows_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disabling_remote_user_account_control_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disabling_systemrestore_in_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[disabling_task_manager_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[dllhost_with_no_command_line_arguments_with_network_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[dns_exfiltration_using_nslookup_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[domain_account_discovery_with_dsquery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[domain_account_discovery_with_net_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[domain_account_discovery_with_wmic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[domain_controller_discovery_with_nltest_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[domain_controller_discovery_with_wmic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[domain_group_discovery_with_adsisearcher_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[domain_group_discovery_with_dsquery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[domain_group_discovery_with_net_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[domain_group_discovery_with_wmic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[download_files_using_telegram_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[drop_icedid_license_dat_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[dsquery_domain_discovery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[dump_lsass_via_comsvcs_dll_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[dump_lsass_via_procdump_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[elevated_group_discovery_with_net_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[elevated_group_discovery_with_powerview_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[elevated_group_discovery_with_wmic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[enable_rdp_in_other_port_number_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[enable_wdigest_uselogoncredential_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[enumerate_users_local_group_using_telegram_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[esentutl_sam_copy_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[etw_registry_disabled_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[eventvwr_uac_bypass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[excel_spawning_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[excel_spawning_windows_script_host_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[excessive_attempt_to_disable_services_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[excessive_distinct_processes_from_windows_temp_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[excessive_file_deletion_in_windefender_folder_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[excessive_number_of_service_control_start_as_disabled_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[excessive_number_of_taskhost_processes_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[excessive_service_stop_attempt_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[excessive_usage_of_cacls_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[excessive_usage_of_net_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[excessive_usage_of_nslookup_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[excessive_usage_of_sc_service_utility_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[excessive_usage_of_taskkill_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[executable_file_written_in_administrative_smb_share_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[executables_or_script_creation_in_suspicious_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[execute_javascript_with_jscript_com_clsid_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[execution_of_file_with_multiple_extensions_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[extraction_of_registry_hives_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[file_with_samsam_extension_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[firewall_allowed_program_enable_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[fodhelper_uac_bypass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[fsutil_zeroing_file_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[get_addefaultdomainpasswordpolicy_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[get_aduser_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[get_aduser_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[get_aduserresultantpasswordpolicy_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[get_aduserresultantpasswordpolicy_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[get_domainpolicy_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[get_domainpolicy_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[get_domaintrust_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[get_domaintrust_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[get_domainuser_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[get_domainuser_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[get_foresttrust_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[get_foresttrust_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[get_wmiobject_group_discovery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[get_wmiobject_group_discovery_with_script_block_logging_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getadcomputer_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getadcomputer_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getadgroup_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getadgroup_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getcurrent_user_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getcurrent_user_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getdomaincomputer_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getdomaincomputer_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getdomaincontroller_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getdomaincontroller_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getdomaingroup_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getdomaingroup_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getlocaluser_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getlocaluser_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getnettcpconnection_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getnettcpconnection_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getwmiobject_ds_computer_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getwmiobject_ds_computer_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getwmiobject_ds_group_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getwmiobject_ds_group_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getwmiobject_ds_user_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getwmiobject_ds_user_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getwmiobject_user_account_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[getwmiobject_user_account_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[gpupdate_with_no_command_line_arguments_with_network_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[hide_user_account_from_sign_in_screen_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[hiding_files_and_directories_with_attrib_exe_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[high_frequency_copy_of_files_in_network_share_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[high_process_termination_frequency_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[hunting_for_log4shell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[icacls_deny_command_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[icacls_grant_command_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[icedid_exfiltrated_archived_file_creation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[impacket_lateral_movement_commandline_parameters_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[interactive_session_on_remote_endpoint_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[java_class_file_download_by_java_user_agent_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[jscript_execution_using_cscript_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kerberoasting_spn_request_with_rc4_encryption_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kerberos_pre_authentication_flag_disabled_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[known_services_killed_by_ransomware_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_add_files_in_known_crontab_directories_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_add_user_account_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_at_allow_config_file_creation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_at_application_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_change_file_owner_to_root_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_common_process_for_elevation_control_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_dd_file_overwrite_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_doas_conf_file_creation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_doas_tool_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_edit_cron_table_parameter_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_file_created_in_kernel_driver_directory_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_file_creation_in_init_boot_directory_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_file_creation_in_profile_directory_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_insert_kernel_module_using_insmod_utility_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_install_kernel_module_using_modprobe_utility_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_java_spawning_shell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_nopasswd_entry_in_sudoers_file_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_pkexec_privilege_escalation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_possible_access_or_modification_of_sshd_config_file_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_possible_access_to_credential_files_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_possible_access_to_sudoers_file_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_possible_append_command_to_at_allow_config_file_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_possible_append_command_to_profile_config_file_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_possible_cronjob_modification_with_editor_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_possible_ssh_key_file_creation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_preload_hijack_library_calls_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_service_file_created_in_systemd_directory_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_service_restarted_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_service_started_or_enabled_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_setuid_using_chmod_utility_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_setuid_using_setcap_utility_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_sudo_or_su_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_sudoers_tmp_file_creation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_system_network_discovery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[linux_visudo_utility_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[loading_of_dynwrapx_module_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[local_account_discovery_with_net_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[local_account_discovery_with_wmic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[log4shell_cve_2021_44228_exploitation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[logon_script_event_trigger_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[macos_lolbin_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[mailsniper_invoke_functions_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[malicious_inprocserver32_modification_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[malicious_powershell_executed_as_a_service_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[malicious_powershell_process___encoded_command_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[malicious_powershell_process___execution_policy_bypass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[malicious_powershell_process_with_obfuscation_techniques_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[mimikatz_passtheticket_commandline_parameters_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[mmc_lolbas_execution_process_spawn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[modification_of_wallpaper_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[modify_acl_permission_to_files_or_folder_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[monitor_registry_keys_for_print_monitors_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[ms_scripting_process_loading_ldap_module_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[ms_scripting_process_loading_wmi_module_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[msbuild_suspicious_spawned_by_script_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[mshta_spawning_rundll32_or_regsvr32_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[mshtml_module_load_in_office_product_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[msi_module_loaded_by_non_system_binary_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[msmpeng_application_dll_side_loading_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[multiple_users_failing_to_authenticate_from_host_using_kerberos_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[multiple_users_failing_to_authenticate_from_host_using_ntlm_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[multiple_users_failing_to_authenticate_from_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[multiple_users_remotely_failing_to_authenticate_from_host_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[net_localgroup_discovery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[net_profiler_uac_bypass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[network_connection_discovery_with_arp_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[network_connection_discovery_with_net_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[network_connection_discovery_with_netstat_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[network_discovery_using_route_windows_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[nishang_powershelltcponeline_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[nltest_domain_trust_discovery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[non_chrome_process_accessing_chrome_default_dir_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[non_firefox_process_access_firefox_profile_dir_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[ntdsutil_export_ntds_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[office_application_drop_executable_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[office_application_spawn_regsvr32_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[office_application_spawn_rundll32_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[office_document_creating_schedule_task_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[office_document_executing_macro_code_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[office_document_spawned_child_process_to_download_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[office_product_spawn_cmd_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[office_product_spawning_bitsadmin_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[office_product_spawning_certutil_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[office_product_spawning_mshta_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[office_product_spawning_rundll32_with_no_dll_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[office_product_spawning_wmic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[office_product_writing_cab_or_inf_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[office_spawning_control_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[outbound_network_connection_from_java_using_default_ports_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[overwriting_accessibility_binaries_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[password_policy_discovery_with_net_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[permission_modification_using_takeown_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[petitpotam_network_share_access_request_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[petitpotam_suspicious_kerberos_tgt_request_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[ping_sleep_batch_command_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[possible_browser_pass_view_parameter_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[possible_lateral_movement_powershell_spawn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[potentially_malicious_code_on_commandline_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[powershell_4104_hunting_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[powershell___connect_to_internet_with_hidden_window_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[powershell_creating_thread_mutex_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[powershell_disable_security_monitoring_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[powershell_domain_enumeration_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[powershell_enable_smb1protocol_feature_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[powershell_execute_com_object_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[powershell_fileless_process_injection_via_getprocaddress_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[powershell_fileless_script_contains_base64_encoded_content_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[powershell_get_localgroup_discovery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[powershell_get_localgroup_discovery_with_script_block_logging_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[powershell_loading_dotnet_into_memory_via_reflection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[powershell_processing_stream_of_data_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[powershell_remote_thread_to_known_windows_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[powershell_remove_windows_defender_directory_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[powershell_start_bitstransfer_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[powershell_using_memory_as_backing_store_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[powershell_windows_defender_exclusion_commands_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[prevent_automatic_repair_mode_using_bcdedit_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[print_spooler_adding_a_printer_driver_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[print_spooler_failed_to_load_a_plug_in_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[process_creating_lnk_file_in_suspicious_location_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[process_deleting_its_process_file_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[process_execution_via_wmi_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[process_kill_base_on_file_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[process_writing_dynamicwrapperx_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[processes_launching_netsh_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[ransomware_notes_bulk_creation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[recon_avproduct_through_pwh_or_wmi_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[recon_using_wmi_class_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[recursive_delete_of_directory_in_batch_cmd_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[reg_exe_manipulating_windows_services_registry_keys_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[registry_keys_for_creating_shim_databases_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[registry_keys_used_for_persistence_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[registry_keys_used_for_privilege_escalation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[regsvr32_silent_and_install_param_dll_loading_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[regsvr32_with_known_silent_switch_cmdline_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[remcos_client_registry_install_entry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[remcos_rat_file_creation_in_remcos_folder_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[remote_process_instantiation_via_dcom_and_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[remote_process_instantiation_via_dcom_and_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[remote_process_instantiation_via_winrm_and_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[remote_process_instantiation_via_winrm_and_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[remote_process_instantiation_via_winrm_and_winrs_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[remote_process_instantiation_via_wmi_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[remote_process_instantiation_via_wmi_and_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[remote_process_instantiation_via_wmi_and_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[remote_system_discovery_with_adsisearcher_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[remote_system_discovery_with_dsquery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[remote_system_discovery_with_net_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[remote_system_discovery_with_wmic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[remote_wmi_command_attempt_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[resize_shadowstorage_volume_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[revil_common_exec_parameter_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[revil_registry_entry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[rubeus_command_line_parameters_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[rubeus_kerberos_ticket_exports_through_winlogon_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[runas_execution_in_commandline_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[rundll32_control_rundll_hunt_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[rundll32_control_rundll_world_writable_directory_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[rundll32_create_remote_thread_to_a_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[rundll32_createremotethread_in_browser_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[rundll32_dnsquery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[rundll32_process_creating_exe_dll_files_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[rundll32_shimcache_flush_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[rundll32_with_no_command_line_arguments_with_network_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[rundll_loading_dll_by_ordinal_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[ryuk_test_files_detected_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[ryuk_wake_on_lan_command_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[sam_database_file_access_attempt_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[samsam_test_file_write_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[sc_exe_manipulating_windows_services_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[schcache_change_by_app_connect_and_create_adsi_object_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[schedule_task_with_http_command_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[schedule_task_with_rundll32_command_trigger_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[scheduled_task_creation_on_remote_endpoint_using_at_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[scheduled_task_deleted_or_created_via_cmd_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[scheduled_task_initiation_on_remote_endpoint_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[schtasks_run_task_on_demand_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[schtasks_scheduling_job_on_remote_system_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[schtasks_used_for_forcing_a_reboot_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[screensaver_event_trigger_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[script_execution_via_wmi_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[sdclt_uac_bypass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[sdelete_application_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[searchprotocolhost_with_no_command_line_with_network_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[secretdumps_offline_ntds_dumping_tool_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[serviceprincipalnames_discovery_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[serviceprincipalnames_discovery_with_setspn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[services_escalate_exe_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[services_lolbas_execution_process_spawn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[shim_database_file_creation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[shim_database_installation_with_suspicious_parameters_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[short_lived_scheduled_task_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[short_lived_windows_accounts_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[silentcleanup_uac_bypass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[single_letter_process_on_endpoint_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[slui_runas_elevated_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[slui_spawning_a_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[spoolsv_spawning_rundll32_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[spoolsv_suspicious_loaded_modules_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[spoolsv_suspicious_process_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[spoolsv_writing_a_dll_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[spoolsv_writing_a_dll___sysmon_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[sqlite_module_in_temp_folder_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[start_up_during_safe_mode_boot_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_computer_account_name_change_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_copy_on_system32_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_dllhost_no_command_line_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_driver_loaded_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_event_log_service_behavior_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_gpupdate_no_command_line_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_icedid_rundll32_cmdline_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_image_creation_in_appdata_folder_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_kerberos_service_ticket_request_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_linux_discovery_commands_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_microsoft_workflow_compiler_rename_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_microsoft_workflow_compiler_usage_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_msbuild_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_msbuild_rename_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_msbuild_spawn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_mshta_child_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_mshta_spawn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_process_dns_query_known_abuse_web_services_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_process_file_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_process_with_discord_dns_query_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_reg_exe_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_regsvr32_register_suspicious_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_rundll32_dllregisterserver_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_rundll32_plugininit_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_rundll32_startw_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_rundll32_no_command_line_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_scheduled_task_from_public_directory_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_searchprotocolhost_no_command_line_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_ticket_granting_ticket_request_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_wav_file_in_appdata_folder_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_wevtutil_usage_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_writes_to_windows_recycle_bin_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[svchost_lolbas_execution_process_spawn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[system_info_gathering_using_dxdiag_application_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[system_information_discovery_detection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[system_processes_run_from_unexpected_locations_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[system_user_discovery_with_query_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[system_user_discovery_with_whoami_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[time_provider_persistence_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[trickbot_named_pipe_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[uac_bypass_mmc_load_unsigned_dll_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[uac_bypass_with_colorui_com_object_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[unified_messaging_service_spawning_a_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[uninstall_app_using_msiexec_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[unload_sysmon_filter_driver_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[unloading_amsi_via_reflection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[unusual_number_of_kerberos_service_tickets_requested_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[user_discovery_with_env_vars_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[user_discovery_with_env_vars_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[usn_journal_deletion_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[vbscript_execution_using_wscript_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[verclsid_clsid_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[w3wp_spawning_shell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[wbadmin_delete_system_backups_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[wbemprox_com_object_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[wermgr_process_connecting_to_ip_check_web_services_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[wermgr_process_create_executable_file_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[wermgr_process_spawned_cmd_or_powershell_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[wget_download_and_bash_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_adfind_exe_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_curl_download_to_suspicious_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_curl_upload_to_remote_destination_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_defender_exclusion_registry_entry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_disable_change_password_through_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_disable_lock_workstation_feature_through_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_disable_logoff_button_through_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_disable_memory_crash_dump_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_disable_notification_center_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_disable_shutdown_button_through_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_disable_windows_group_policy_features_through_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_disableantispyware_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_disabled_users_failing_to_authenticate_kerberos_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_diskcryptor_usage_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_diskshadow_proxy_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_dism_remove_defender_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_dotnet_binary_in_non_standard_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_event_for_service_disabled_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_event_log_cleared_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_excessive_disabled_services_event_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_file_without_extension_in_critical_folder_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_hide_notification_features_through_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_high_file_deletion_frequency_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_hunting_system_account_targeting_lsass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_installutil_credential_theft_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_installutil_in_non_standard_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_installutil_remote_network_connection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_installutil_uninstall_option_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_installutil_uninstall_option_with_network_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_installutil_url_in_command_line_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_invalid_users_failed_authentication_via_kerberos_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_modify_show_compress_color_and_info_tip_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_nirsoft_advancedrun_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_nirsoft_utilities_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_non_system_account_targeting_lsass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_possible_credential_dumping_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_process_with_namedpipe_commandline_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_raccine_scheduled_task_deletion_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_rasautou_dll_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_raw_access_to_disk_volume_partition_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_raw_access_to_master_boot_record_drive_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_remote_assistance_spawning_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_schtasks_create_run_as_system_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_security_account_manager_stopped_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_service_created_with_suspicious_service_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_service_created_within_public_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_service_creation_on_remote_endpoint_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_service_creation_using_registry_entry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_service_initiation_on_remote_endpoint_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_users_authenticate_using_explicit_credentials_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_wmi_process_call_create_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[winevent_scheduled_task_created_to_spawn_shell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[winevent_scheduled_task_created_within_public_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[winevent_windows_task_scheduler_event_action_started_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[winhlp32_spawning_a_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[winword_spawning_cmd_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[winword_spawning_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[winword_spawning_windows_script_host_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[wmi_permanent_event_subscription___sysmon_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[wmi_recon_running_process_or_services_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[wmic_group_discovery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[wmic_noninteractive_app_uninstallation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[wmic_xsl_execution_via_url_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[wmiprsve_lolbas_execution_process_spawn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[wscript_or_cscript_suspicious_child_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[wsmprovhost_lolbas_execution_process_spawn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[wsreset_uac_bypass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[xmrig_driver_loaded_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[xsl_script_execution_with_wmic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_new_login_attempts_to_routers_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[email_attachments_with_lots_of_spaces_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[email_files_written_outside_of_the_outlook_directory_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[email_servers_sending_high_volume_traffic_to_hosts_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[monitor_email_for_brand_abuse_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[no_windows_updates_in_a_time_frame_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[okta_account_lockout_events_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[okta_failed_sso_attempts_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[okta_user_logins_from_multiple_cities_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_email_attachment_extensions_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_java_classes_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[web_servers_executing_suspicious_processes_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[abnormally_high_number_of_cloud_instances_destroyed_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[abnormally_high_number_of_cloud_instances_launched_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[amazon_eks_kubernetes_cluster_scan_detection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[amazon_eks_kubernetes_pod_scan_detection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_detect_attach_to_role_policy_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_detect_permanent_key_creation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_detect_role_creation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_detect_sts_assume_role_abuse_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[aws_detect_sts_get_session_token_abuse_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_gcp_storage_access_from_a_new_ip_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_new_open_gcp_storage_buckets_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_s3_access_from_a_new_ip_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_spike_in_aws_security_hub_alerts_for_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_spike_in_blocked_outbound_traffic_from_your_aws_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_spike_in_s3_bucket_deletion_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[gcp_detect_gcploit_framework_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[gcp_kubernetes_cluster_pod_scan_detection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[gdrive_suspicious_file_sharing_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[gsuite_suspicious_calendar_invite_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[high_number_of_login_failures_from_a_single_source_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[kubernetes_aws_detect_suspicious_kubectl_calls_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[new_container_uploaded_to_aws_ecr_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[child_processes_of_spoolsv_exe_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_baron_samedit_cve_2021_3156_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_baron_samedit_cve_2021_3156_segfault_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_baron_samedit_cve_2021_3156_via_osquery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_computer_changed_with_anonymous_account_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_outlook_exe_writing_a_zip_file_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_rare_executables_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detection_of_tools_built_by_nirsoft_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[exchange_powershell_abuse_via_ssrf_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[exchange_powershell_module_usage_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[first_time_seen_child_process_of_zoom_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[first_time_seen_running_windows_service_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[macos___re_opened_applications_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[ms_exchange_mailbox_replication_service_writing_active_server_pages_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[print_processor_registry_autostart_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[processes_tapping_keyboard_events_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[randomly_generated_scheduled_task_name_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[randomly_generated_windows_service_name_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[remote_desktop_process_running_on_system_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[spike_in_file_writes_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[sunburst_correlation_dll_and_network_event_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_curl_network_connection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_plistbuddy_usage_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_plistbuddy_usage_via_osquery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[suspicious_sqlite3_lsquarantine_behavior_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[unusual_number_of_computer_service_tickets_requested_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[unusual_number_of_remote_endpoint_authentication_events_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[unusually_long_command_line_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[unusually_long_command_line___mltk_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[windows_java_spawning_shells_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[winrm_spawning_a_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[wmi_permanent_event_subscription_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[wmi_temporary_event_subscription_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_arp_poisoning_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_ipv6_network_infrastructure_threats_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_large_outbound_icmp_packets_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_outbound_smb_traffic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_port_security_violation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_rogue_dhcp_server_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_snicat_sni_exfiltration_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_software_download_to_network_device_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_traffic_mirroring_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_unauthorized_assets_by_mac_address_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_windows_dns_sigred_via_splunk_stream_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_windows_dns_sigred_via_zeek_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_zerologon_via_zeek_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[dns_query_length_outliers___mltk_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[excessive_dns_failures_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[hosts_receiving_high_volume_of_network_traffic_from_email_server_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[large_volume_of_dns_any_queries_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[prohibited_network_traffic_allowed_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[protocol_or_port_mismatch_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[protocols_passing_authentication_in_cleartext_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[remote_desktop_network_bruteforce_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[remote_desktop_network_traffic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[smb_traffic_spike_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[smb_traffic_spike___mltk_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[tor_traffic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[unusually_long_content_type_length_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_attackers_scanning_for_vulnerable_jboss_servers_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_f5_tmui_rce_cve_2020_5902_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_malicious_requests_to_exploit_jboss_servers_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[monitor_web_traffic_for_brand_abuse_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[sql_injection_with_long_urls_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[supernova_webshell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_hosts_connecting_to_dynamic_domain_providers_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[detect_outbound_ldap_traffic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[dns_query_length_with_high_standard_deviation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[multiple_archive_files_http_post_traffic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[plain_http_post_exfiltrated_data_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[log4shell_jndi_payload_injection_attempt_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[log4shell_jndi_payload_injection_with_outbound_connection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
 
 [aws_cloudwatchlogs_eks]
 definition = sourcetype="aws:cloudwatchlogs:eks"
@@ -3538,10 +206,6 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = eventtype=okta_log
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
 
-[osquery]
-definition = sourcetype=osquery:results
-description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
-
 [osquery_process]
 definition = eventtype="osquery-process"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
@@ -3883,3 +547,3751 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = index=zeek sourcetype="zeek:ssl:json"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
 
+[7zip_commandline_to_smb_share_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_cloud_provisioning_from_previously_unseen_city_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_cloud_provisioning_from_previously_unseen_country_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_cloud_provisioning_from_previously_unseen_ip_address_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_cloud_provisioning_from_previously_unseen_region_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_create_policy_version_to_allow_all_resources_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_createaccesskey_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_createloginprofile_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_cross_account_activity_from_previously_unseen_account_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_detect_users_with_kms_keys_performing_encryption_s3_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_ecr_container_scanning_findings_high_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_ecr_container_scanning_findings_low_informational_unknown_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_ecr_container_scanning_findings_medium_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_ecr_container_upload_outside_business_hours_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_ecr_container_upload_unknown_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_eks_kubernetes_cluster_sensitive_object_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_excessive_security_scanning_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_iam_accessdenied_discovery_events_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_iam_assume_role_policy_brute_force_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_iam_delete_policy_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_iam_failure_group_deletion_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_iam_successful_group_deletion_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_investigate_security_hub_alerts_by_dest_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_investigate_user_activities_by_arn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_investigate_user_activities_by_accesskeyid_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_lambda_updatefunctioncode_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_network_acl_details_from_id_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_network_access_control_list_created_with_all_open_ports_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_network_access_control_list_deleted_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_network_interface_details_via_resourceid_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_s3_bucket_details_via_bucketname_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_saml_access_by_provider_user_and_principal_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_saml_update_identity_provider_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_setdefaultpolicyversion_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_updateloginprofile_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[abnormally_high_aws_instances_launched_by_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[abnormally_high_aws_instances_launched_by_user___mltk_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[abnormally_high_aws_instances_terminated_by_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[abnormally_high_aws_instances_terminated_by_user___mltk_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[abnormally_high_number_of_cloud_infrastructure_api_calls_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[abnormally_high_number_of_cloud_instances_destroyed_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[abnormally_high_number_of_cloud_instances_launched_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[abnormally_high_number_of_cloud_security_group_api_calls_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[access_lsass_memory_for_dump_creation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[account_discovery_with_net_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[active_setup_registry_autostart_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[add_defaultuser_and_password_in_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[add_prohibited_processes_to_enterprise_security_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[add_or_set_windows_defender_exclusion_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[adsisearcher_account_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[all_backup_logs_for_host_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[allow_file_and_printing_sharing_in_firewall_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[allow_inbound_traffic_by_firewall_rule_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[allow_inbound_traffic_in_firewall_rule_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[allow_network_discovery_in_firewall_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[allow_operation_with_consent_admin_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[amazon_eks_kubernetes_pod_scan_detection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[amazon_eks_kubernetes_activity_by_src_ip_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[amazon_eks_kubernetes_cluster_scan_detection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[anomalous_usage_of_7zip_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[any_powershell_downloadfile_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[any_powershell_downloadstring_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[attacker_tools_on_endpoint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[attempt_to_add_certificate_to_untrusted_store_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[attempt_to_stop_security_service_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[attempted_credential_dump_from_registry_via_reg_exe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[auto_admin_logon_registry_entry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[bcdedit_failure_recovery_modification_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[bits_job_persistence_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[bitsadmin_download_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[baseline_of_cloud_infrastructure_api_calls_per_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[baseline_of_cloud_instances_destroyed_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[baseline_of_cloud_instances_launched_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[baseline_of_cloud_security_group_api_calls_per_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[baseline_of_api_calls_per_user_arn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[baseline_of_command_line_length___mltk_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[baseline_of_dns_query_length___mltk_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[baseline_of_excessive_aws_instances_launched_by_user___mltk_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[baseline_of_excessive_aws_instances_terminated_by_user___mltk_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[baseline_of_network_acl_activity_by_arn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[baseline_of_s3_bucket_deletion_activity_by_arn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[baseline_of_smb_traffic___mltk_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[baseline_of_security_group_activity_by_arn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[baseline_of_blocked_outbound_traffic_from_aws_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[batch_file_write_to_system32_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[bcdedit_command_back_to_normal_mode_boot_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[chcp_command_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[cmd_carry_out_string_command_parameter_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[cmd_echo_pipe___escalation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[cmlua_or_cmstplua_uac_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[csc_net_on_the_fly_compilation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[certutil_download_with_urlcache_and_split_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[certutil_download_with_verifyctl_and_split_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[certutil_with_decode_argument_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[certutil_exe_certificate_extraction_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[change_default_file_association_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[change_to_safe_mode_with_network_config_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[check_elevated_cmd_using_whoami_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[child_processes_of_spoolsv_exe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[circle_ci_disable_security_job_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[circle_ci_disable_security_step_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[clear_unallocated_sector_using_cipher_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[clients_connecting_to_multiple_dns_servers_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[clop_common_exec_parameter_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[clop_ransomware_known_service_name_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[cloud_api_calls_from_previously_unseen_user_roles_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[cloud_compute_instance_created_by_previously_unseen_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[cloud_compute_instance_created_in_previously_unused_region_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[cloud_compute_instance_created_with_previously_unseen_image_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[cloud_compute_instance_created_with_previously_unseen_instance_type_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[cloud_instance_modified_by_previously_unseen_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[cloud_network_access_control_list_deleted_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[cloud_provisioning_activity_from_previously_unseen_city_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[cloud_provisioning_activity_from_previously_unseen_country_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[cloud_provisioning_activity_from_previously_unseen_ip_address_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[cloud_provisioning_activity_from_previously_unseen_region_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[cmdline_tool_not_executed_in_cmd_shell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[cobalt_strike_named_pipes_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[common_ransomware_extensions_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[common_ransomware_notes_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[conti_common_exec_parameter_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[control_loading_from_world_writable_directory_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[correlation_by_repository_and_risk_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[correlation_by_user_and_risk_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[count_of_unique_ips_connecting_to_ports_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[count_of_assets_by_category_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[create_remote_thread_in_shell_application_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[create_remote_thread_into_lsass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[create_a_list_of_approved_aws_service_accounts_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[create_local_admin_accounts_using_net_exe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[create_or_delete_windows_shares_using_net_exe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[creation_of_shadow_copy_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[creation_of_shadow_copy_with_wmic_and_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[creation_of_lsass_dump_with_taskmgr_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[credential_dumping_via_copy_command_from_shadow_copy_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[credential_dumping_via_symlink_to_shadow_copy_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[curl_download_and_bash_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[dllhost_with_no_command_line_arguments_with_network_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[dns_exfiltration_using_nslookup_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[dns_query_length_outliers___mltk_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[dns_query_length_with_high_standard_deviation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[dns_query_requests_resolved_by_unauthorized_dns_servers_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[dns_record_changed_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[dnstwist_domain_names_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[dsquery_domain_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[delete_shadowcopy_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[deleting_of_net_users_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[deleting_shadow_copies_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_api_activity_from_users_without_mfa_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_arp_poisoning_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_aws_api_activities_from_unapproved_accounts_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_aws_console_login_by_new_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_aws_console_login_by_user_from_new_city_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_aws_console_login_by_user_from_new_country_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_aws_console_login_by_user_from_new_region_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_activity_related_to_pass_the_hash_attacks_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_azurehound_command_line_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_azurehound_file_modifications_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_baron_samedit_cve_2021_3156_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_baron_samedit_cve_2021_3156_segfault_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_baron_samedit_cve_2021_3156_via_osquery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_computer_changed_with_anonymous_account_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_copy_of_shadowcopy_with_script_block_logging_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_credential_dumping_through_lsass_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_empire_with_powershell_script_block_logging_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_excessive_account_lockouts_from_endpoint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_excessive_user_account_lockouts_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_exchange_web_shell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_f5_tmui_rce_cve_2020_5902_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_gcp_storage_access_from_a_new_ip_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_html_help_renamed_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_html_help_spawn_child_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_html_help_url_in_command_line_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_html_help_using_infotech_storage_handlers_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_ipv6_network_infrastructure_threats_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_large_outbound_icmp_packets_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_long_dns_txt_record_response_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_mshta_url_in_command_line_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_mimikatz_using_loaded_images_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_mimikatz_via_powershell_and_eventcode_4703_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_mimikatz_with_powershell_script_block_logging_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_new_local_admin_account_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_new_login_attempts_to_routers_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_new_open_gcp_storage_buckets_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_new_open_s3_buckets_over_aws_cli_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_new_open_s3_buckets_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_outbound_ldap_traffic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_outbound_smb_traffic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_outlook_exe_writing_a_zip_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_path_interception_by_creation_of_program_exe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_port_security_violation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_prohibited_applications_spawning_cmd_exe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_psexec_with_accepteula_flag_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_rclone_command_line_usage_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_rare_executables_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_regasm_spawning_a_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_regasm_with_network_connection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_regasm_with_no_command_line_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_regsvcs_spawning_a_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_regsvcs_with_network_connection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_regsvcs_with_no_command_line_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_regsvr32_application_control_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_renamed_7_zip_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_renamed_psexec_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_renamed_rclone_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_renamed_winrar_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_rogue_dhcp_server_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_rundll32_application_control_bypass___advpack_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_rundll32_application_control_bypass___setupapi_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_rundll32_application_control_bypass___syssetup_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_rundll32_inline_hta_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_s3_access_from_a_new_ip_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_snicat_sni_exfiltration_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_sharphound_command_line_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_sharphound_file_modifications_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_sharphound_usage_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_software_download_to_network_device_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_spike_in_aws_api_activity_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_spike_in_aws_security_hub_alerts_for_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_spike_in_network_acl_activity_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_spike_in_s3_bucket_deletion_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_spike_in_security_group_activity_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_spike_in_blocked_outbound_traffic_from_your_aws_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_traffic_mirroring_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_usb_device_insertion_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_unauthorized_assets_by_mac_address_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_use_of_cmd_exe_to_launch_script_interpreters_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_wmi_event_subscription_persistence_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_windows_dns_sigred_via_splunk_stream_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_windows_dns_sigred_via_zeek_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_zerologon_via_zeek_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_attackers_scanning_for_vulnerable_jboss_servers_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_hosts_connecting_to_dynamic_domain_providers_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_malicious_requests_to_exploit_jboss_servers_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_mshta_inline_hta_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_mshta_renamed_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_new_api_calls_from_user_roles_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_new_user_aws_console_login_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_processes_used_for_system_network_configuration_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_shared_ec2_snapshot_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detect_web_traffic_to_dynamic_domain_providers_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detection_of_dns_tunnels_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[detection_of_tools_built_by_nirsoft_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disable_amsi_through_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disable_defender_antivirus_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disable_defender_blockatfirstseen_feature_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disable_defender_enhanced_notification_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disable_defender_mpengine_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disable_defender_spynet_reporting_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disable_defender_submit_samples_consent_feature_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disable_etw_through_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disable_logs_using_wevtutil_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disable_registry_tool_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disable_schedule_task_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disable_security_logs_using_minint_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disable_show_hidden_files_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disable_uac_remote_restriction_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disable_windows_app_hotkeys_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disable_windows_behavior_monitoring_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disable_windows_smartscreen_protection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disabled_kerberos_pre_authentication_discovery_with_powerview_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disabling_cmd_application_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disabling_controlpanel_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disabling_defender_services_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disabling_firewall_with_netsh_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disabling_folderoptions_windows_feature_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disabling_net_user_account_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disabling_norun_windows_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disabling_remote_user_account_control_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disabling_systemrestore_in_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[disabling_task_manager_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[discover_dns_records_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[domain_account_discovery_with_net_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[domain_account_discovery_with_dsquery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[domain_account_discovery_with_wmic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[domain_controller_discovery_with_nltest_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[domain_controller_discovery_with_wmic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[domain_group_discovery_with_dsquery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[domain_group_discovery_with_net_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[domain_group_discovery_with_wmic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[domain_group_discovery_with_adsisearcher_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[download_files_using_telegram_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[drop_icedid_license_dat_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[dump_lsass_via_comsvcs_dll_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[dump_lsass_via_procdump_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[dump_lsass_via_procdump_rename_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[ec2_instance_modified_with_previously_unseen_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[ec2_instance_started_in_previously_unseen_region_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[ec2_instance_started_with_previously_unseen_ami_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[ec2_instance_started_with_previously_unseen_instance_type_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[ec2_instance_started_with_previously_unseen_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[etw_registry_disabled_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[elevated_group_discovery_with_net_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[elevated_group_discovery_with_wmic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[elevated_group_discovery_with_powerview_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[email_attachments_with_lots_of_spaces_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[email_files_written_outside_of_the_outlook_directory_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[email_servers_sending_high_volume_traffic_to_hosts_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[enable_rdp_in_other_port_number_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[enable_wdigest_uselogoncredential_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[enumerate_users_local_group_using_telegram_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[esentutl_sam_copy_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[eventvwr_uac_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[excel_spawning_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[excel_spawning_windows_script_host_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[excessive_attempt_to_disable_services_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[excessive_dns_failures_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[excessive_file_deletion_in_windefender_folder_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[excessive_service_stop_attempt_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[excessive_usage_of_cacls_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[excessive_usage_of_net_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[excessive_usage_of_sc_service_utility_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[excessive_usage_of_taskkill_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[excessive_usage_of_nslookup_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[excessive_number_of_distinct_processes_created_in_windows_temp_folder_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[excessive_number_of_service_control_start_as_disabled_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[excessive_number_of_taskhost_processes_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[exchange_powershell_abuse_via_ssrf_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[exchange_powershell_module_usage_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[executable_file_written_in_administrative_smb_share_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[executables_or_script_creation_in_suspicious_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[execute_javascript_with_jscript_com_clsid_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[execution_of_file_with_spaces_before_extension_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[execution_of_file_with_multiple_extensions_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[extended_period_without_successful_netbackup_backups_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[extraction_of_registry_hives_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[file_with_samsam_extension_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[firewall_allowed_program_enable_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[first_time_seen_child_process_of_zoom_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[first_time_seen_running_windows_service_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[first_time_seen_command_line_argument_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[fodhelper_uac_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[fsutil_zeroing_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[gcp_detect_accounts_with_high_risk_roles_by_project_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[gcp_detect_gcploit_framework_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[gcp_detect_high_risk_permissions_by_resource_and_account_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[gcp_gcr_container_uploaded_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[gcp_kubernetes_activity_by_src_ip_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[gcp_kubernetes_cluster_pod_scan_detection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[gcp_kubernetes_cluster_scan_detection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[gpupdate_with_no_command_line_arguments_with_network_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[gsuite_email_suspicious_attachment_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[gdrive_suspicious_file_sharing_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_addefaultdomainpasswordpolicy_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_aduser_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_aduser_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_aduserresultantpasswordpolicy_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_aduserresultantpasswordpolicy_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_all_aws_activity_from_city_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_all_aws_activity_from_country_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_all_aws_activity_from_ip_address_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_all_aws_activity_from_region_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_backup_logs_for_endpoint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_certificate_logs_for_a_domain_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_dns_server_history_for_a_host_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_dns_traffic_ratio_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_domainpolicy_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_domainpolicy_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_domainuser_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_domainuser_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_ec2_instance_details_by_instanceid_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_ec2_launch_details_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_email_info_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_emails_from_specific_sender_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_first_occurrence_and_last_occurrence_of_a_mac_address_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_history_of_email_sources_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_logon_rights_modifications_for_endpoint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_logon_rights_modifications_for_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_notable_history_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_outbound_emails_to_hidden_cobra_threat_actors_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_parent_process_info_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_process_file_activity_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_process_info_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_process_information_for_port_activity_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_process_responsible_for_the_dns_traffic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_sysmon_wmi_activity_for_host_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_wmiobject_group_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_wmiobject_group_discovery_with_script_block_logging_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_web_session_information_via_session_id_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_domaintrust_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_domaintrust_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_foresttrust_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_foresttrust_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getadcomputer_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getadcomputer_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getadgroup_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getadgroup_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getcurrent_user_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getcurrent_user_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getdomaincomputer_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getdomaincomputer_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getdomaincontroller_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getdomaincontroller_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getdomaingroup_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getdomaingroup_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getlocaluser_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getlocaluser_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getnettcpconnection_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getnettcpconnection_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getwmiobject_ds_user_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getwmiobject_ds_user_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getwmiobject_ds_computer_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getwmiobject_ds_computer_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getwmiobject_ds_group_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getwmiobject_ds_group_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getwmiobject_user_account_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getwmiobject_user_account_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[github_dependabot_alert_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[github_pull_request_from_unknown_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[github_commit_changes_in_master_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[github_commit_in_develop_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[gsuite_drive_share_in_external_email_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[gsuite_email_suspicious_subject_with_attachment_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[gsuite_email_with_known_abuse_web_service_link_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[gsuite_outbound_email_with_attachment_to_external_domain_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[gsuite_suspicious_shared_file_name_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[gsuite_suspicious_calendar_invite_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[hide_user_account_from_sign_in_screen_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[hiding_files_and_directories_with_attrib_exe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[high_frequency_copy_of_files_in_network_share_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[high_number_of_login_failures_from_a_single_source_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[high_process_termination_frequency_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[hosts_receiving_high_volume_of_network_traffic_from_email_server_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[hunting_for_log4shell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[icacls_grant_command_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[icacls_deny_command_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[icedid_exfiltrated_archived_file_creation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[identify_new_user_accounts_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[identify_systems_creating_remote_desktop_traffic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[identify_systems_receiving_remote_desktop_traffic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[identify_systems_using_remote_desktop_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[impacket_lateral_movement_commandline_parameters_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[interactive_session_on_remote_endpoint_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[investigate_aws_user_activities_by_user_field_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[investigate_aws_activities_via_region_name_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[investigate_failed_logins_for_multiple_destinations_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[investigate_network_traffic_from_src_ip_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[investigate_okta_activity_by_ip_address_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[investigate_okta_activity_by_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[investigate_pass_the_hash_attempts_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[investigate_pass_the_ticket_attempts_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[investigate_previous_unseen_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[investigate_successful_remote_desktop_authentications_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[investigate_suspicious_strings_in_http_header_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[investigate_user_activities_in_okta_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[investigate_web_posts_from_src_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[java_class_file_download_by_java_user_agent_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[jscript_execution_using_cscript_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kerberoasting_spn_request_with_rc4_encryption_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kerberos_pre_authentication_flag_disabled_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[known_services_killed_by_ransomware_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_aws_detect_rbac_authorization_by_account_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_aws_detect_most_active_service_accounts_by_pod_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_aws_detect_sensitive_role_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_aws_detect_service_accounts_forbidden_failure_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_aws_detect_suspicious_kubectl_calls_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_azure_detect_rbac_authorization_by_account_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_azure_detect_sensitive_object_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_azure_detect_sensitive_role_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_azure_detect_suspicious_kubectl_calls_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_azure_pod_scan_fingerprint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_azure_scan_fingerprint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_gcp_detect_rbac_authorizations_by_account_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_gcp_detect_sensitive_object_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_gcp_detect_sensitive_role_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_gcp_detect_service_accounts_forbidden_failure_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_gcp_detect_suspicious_kubectl_calls_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_nginx_ingress_lfi_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_nginx_ingress_rfi_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_scanner_image_pulling_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[large_volume_of_dns_any_queries_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_add_files_in_known_crontab_directories_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_add_user_account_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_at_allow_config_file_creation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_at_application_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_change_file_owner_to_root_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_common_process_for_elevation_control_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_dd_file_overwrite_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_doas_conf_file_creation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_doas_tool_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_edit_cron_table_parameter_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_file_created_in_kernel_driver_directory_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_file_creation_in_init_boot_directory_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_file_creation_in_profile_directory_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_insert_kernel_module_using_insmod_utility_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_install_kernel_module_using_modprobe_utility_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_java_spawning_shell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_nopasswd_entry_in_sudoers_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_possible_access_or_modification_of_sshd_config_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_possible_access_to_credential_files_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_possible_access_to_sudoers_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_possible_append_command_to_at_allow_config_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_possible_append_command_to_profile_config_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_possible_cronjob_modification_with_editor_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_possible_ssh_key_file_creation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_preload_hijack_library_calls_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_service_file_created_in_systemd_directory_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_service_restarted_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_service_started_or_enabled_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_setuid_using_chmod_utility_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_setuid_using_setcap_utility_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_sudo_or_su_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_sudoers_tmp_file_creation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_system_network_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_visudo_utility_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[linux_pkexec_privilege_escalation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[loading_of_dynwrapx_module_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[local_account_discovery_with_wmic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[local_account_discovery_with_net_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[log4shell_cve_2021_44228_exploitation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[log4shell_jndi_payload_injection_attempt_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[log4shell_jndi_payload_injection_with_outbound_connection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[logon_script_event_trigger_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[ms_scripting_process_loading_ldap_module_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[ms_scripting_process_loading_wmi_module_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[msbuild_suspicious_spawned_by_script_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[mshtml_module_load_in_office_product_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[msi_module_loaded_by_non_system_binary_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[macos___re_opened_applications_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[mailsniper_invoke_functions_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[malicious_inprocserver32_modification_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[malicious_powershell_process___encoded_command_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[malicious_powershell_process___execution_policy_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[malicious_powershell_process___multiple_suspicious_command_line_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[malicious_powershell_process_with_obfuscation_techniques_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[malicious_powershell_executed_as_a_service_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[microsoft_exchange_mailbox_replication_service_writing_active_server_pages_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[mimikatz_passtheticket_commandline_parameters_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[mmc_lolbas_execution_process_spawn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[modification_of_wallpaper_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[modify_acl_permission_to_files_or_folder_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[monitor_dns_for_brand_abuse_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[monitor_email_for_brand_abuse_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[monitor_registry_keys_for_print_monitors_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[monitor_successful_backups_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[monitor_unsuccessful_backups_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[monitor_web_traffic_for_brand_abuse_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[mshta_spawning_rundll32_or_regsvr32_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[msmpeng_application_dll_side_loading_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[multiple_archive_files_http_post_traffic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[multiple_users_attempting_to_authenticate_using_explicit_credentials_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[multiple_users_failing_to_authenticate_from_host_using_kerberos_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[multiple_users_failing_to_authenticate_from_host_using_ntlm_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[multiple_users_failing_to_authenticate_from_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[multiple_users_remotely_failing_to_authenticate_from_host_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[net_profiler_uac_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[nltest_domain_trust_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[net_localgroup_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[network_connection_discovery_with_arp_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[network_connection_discovery_with_net_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[network_connection_discovery_with_netstat_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[network_discovery_using_route_windows_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[new_container_uploaded_to_aws_ecr_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[nishang_powershelltcponeline_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[no_windows_updates_in_a_time_frame_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[non_chrome_process_accessing_chrome_default_dir_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[non_firefox_process_access_firefox_profile_dir_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[ntdsutil_export_ntds_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[o365_add_app_role_assignment_grant_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[o365_added_service_principal_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[o365_bypass_mfa_via_trusted_ip_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[o365_disable_mfa_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[o365_excessive_authentication_failures_alert_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[o365_excessive_sso_logon_errors_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[o365_new_federated_domain_added_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[o365_pst_export_alert_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[o365_suspicious_admin_email_forwarding_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[o365_suspicious_rights_delegation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[o365_suspicious_user_email_forwarding_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[office_application_drop_executable_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[office_application_spawn_regsvr32_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[office_application_spawn_rundll32_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[office_document_creating_schedule_task_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[office_document_executing_macro_code_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[office_document_spawned_child_process_to_download_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[office_product_spawn_cmd_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[office_product_spawning_bitsadmin_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[office_product_spawning_certutil_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[office_product_spawning_mshta_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[office_product_spawning_rundll32_with_no_dll_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[office_product_spawning_wmic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[office_product_writing_cab_or_inf_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[office_spawning_control_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[okta_account_lockout_events_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[okta_failed_sso_attempts_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[okta_user_logins_from_multiple_cities_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[open_redirect_in_splunk_web_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[osquery_pack___coldroot_detection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[outbound_network_connection_from_java_using_default_ports_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[overwriting_accessibility_binaries_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[password_policy_discovery_with_net_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[permission_modification_using_takeown_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[petitpotam_network_share_access_request_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[petitpotam_suspicious_kerberos_tgt_request_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[ping_sleep_batch_command_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[plain_http_post_exfiltrated_data_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[possible_browser_pass_view_parameter_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[possible_lateral_movement_powershell_spawn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[potentially_malicious_code_on_commandline_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[powershell___connect_to_internet_with_hidden_window_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[powershell_4104_hunting_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[powershell_domain_enumeration_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[powershell_get_localgroup_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[powershell_start_bitstransfer_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[powershell_creating_thread_mutex_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[powershell_disable_security_monitoring_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[powershell_enable_smb1protocol_feature_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[powershell_execute_com_object_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[powershell_fileless_process_injection_via_getprocaddress_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[powershell_fileless_script_contains_base64_encoded_content_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[powershell_get_localgroup_discovery_with_script_block_logging_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[powershell_processing_stream_of_data_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[powershell_remote_thread_to_known_windows_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[powershell_remove_windows_defender_directory_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[powershell_using_memory_as_backing_store_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[powershell_windows_defender_exclusion_commands_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[prevent_automatic_repair_mode_using_bcdedit_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_aws_cross_account_activity_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_aws_cross_account_activity___initial_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_aws_cross_account_activity___update_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_aws_provisioning_activity_sources_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_aws_regions_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_cloud_api_calls_per_user_role___initial_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_cloud_api_calls_per_user_role___update_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_cloud_compute_creations_by_user___initial_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_cloud_compute_creations_by_user___update_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_cloud_compute_images___initial_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_cloud_compute_images___update_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_cloud_compute_instance_types___initial_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_cloud_compute_instance_types___update_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_cloud_instance_modifications_by_user___initial_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_cloud_instance_modifications_by_user___update_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_cloud_provisioning_activity_sources___initial_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_cloud_provisioning_activity_sources___update_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_cloud_regions___initial_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_cloud_regions___update_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_ec2_amis_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_ec2_instance_types_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_ec2_launches_by_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_ec2_modifications_by_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_running_windows_services___initial_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_running_windows_services___update_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_users_in_cloudtrail___update_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_users_in_cloudtrail___initial_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_zoom_child_processes___initial_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_zoom_child_processes___update_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_api_call_per_user_roles_in_cloudtrail_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_s3_bucket_access_by_remote_ip_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_command_line_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[previously_seen_users_in_cloudtrail_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[print_processor_registry_autostart_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[print_spooler_adding_a_printer_driver_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[print_spooler_failed_to_load_a_plug_in_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[process_creating_lnk_file_in_suspicious_location_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[process_deleting_its_process_file_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[process_execution_via_wmi_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[process_kill_base_on_file_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[process_writing_dynamicwrapperx_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[processes_tapping_keyboard_events_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[processes_created_by_netsh_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[processes_launching_netsh_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[prohibited_network_traffic_allowed_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[prohibited_software_on_endpoint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[protocol_or_port_mismatch_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[protocols_passing_authentication_in_cleartext_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[randomly_generated_scheduled_task_name_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[randomly_generated_windows_service_name_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[ransomware_notes_bulk_creation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[recon_avproduct_through_pwh_or_wmi_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[recon_using_wmi_class_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[recursive_delete_of_directory_in_batch_cmd_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[reg_exe_manipulating_windows_services_registry_keys_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[reg_exe_used_to_hide_files_directories_via_registry_keys_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[registry_keys_used_for_persistence_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[registry_keys_used_for_privilege_escalation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[registry_keys_for_creating_shim_databases_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[regsvr32_silent_and_install_param_dll_loading_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[regsvr32_with_known_silent_switch_cmdline_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[remcos_rat_file_creation_in_remcos_folder_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[remcos_client_registry_install_entry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[remote_desktop_network_bruteforce_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[remote_desktop_network_traffic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[remote_desktop_process_running_on_system_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[remote_process_instantiation_via_dcom_and_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[remote_process_instantiation_via_dcom_and_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[remote_process_instantiation_via_wmi_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[remote_process_instantiation_via_wmi_and_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[remote_process_instantiation_via_wmi_and_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[remote_process_instantiation_via_winrm_and_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[remote_process_instantiation_via_winrm_and_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[remote_process_instantiation_via_winrm_and_winrs_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[remote_registry_key_modifications_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[remote_system_discovery_with_adsisearcher_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[remote_system_discovery_with_dsquery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[remote_system_discovery_with_net_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[remote_system_discovery_with_wmic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[remote_wmi_command_attempt_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[resize_shadowstorage_volume_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[revil_common_exec_parameter_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[revil_registry_entry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[rubeus_command_line_parameters_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[rubeus_kerberos_ticket_exports_through_winlogon_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[rundll_loading_dll_by_ordinal_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[runas_execution_in_commandline_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[rundll32_control_rundll_hunt_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[rundll32_control_rundll_world_writable_directory_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[rundll32_create_remote_thread_to_a_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[rundll32_createremotethread_in_browser_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[rundll32_dnsquery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[rundll32_lockworkstation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[rundll32_process_creating_exe_dll_files_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[rundll32_shimcache_flush_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[rundll32_with_no_command_line_arguments_with_network_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[ryuk_test_files_detected_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[ryuk_wake_on_lan_command_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[sam_database_file_access_attempt_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[slui_runas_elevated_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[slui_spawning_a_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[smb_traffic_spike_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[smb_traffic_spike___mltk_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[sql_injection_with_long_urls_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[samsam_test_file_write_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[sc_exe_manipulating_windows_services_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[schcache_change_by_app_connect_and_create_adsi_object_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[schedule_task_with_http_command_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[schedule_task_with_rundll32_command_trigger_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[scheduled_task_creation_on_remote_endpoint_using_at_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[scheduled_task_deleted_or_created_via_cmd_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[scheduled_task_initiation_on_remote_endpoint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[scheduled_tasks_used_in_badrabbit_ransomware_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[schtasks_run_task_on_demand_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[schtasks_scheduling_job_on_remote_system_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[schtasks_used_for_forcing_a_reboot_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[screensaver_event_trigger_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[script_execution_via_wmi_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[sdclt_uac_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[sdelete_application_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[searchprotocolhost_with_no_command_line_with_network_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[secretdumps_offline_ntds_dumping_tool_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[serviceprincipalnames_discovery_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[serviceprincipalnames_discovery_with_setspn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[services_escalate_exe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[services_lolbas_execution_process_spawn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[shim_database_file_creation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[shim_database_installation_with_suspicious_parameters_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[short_lived_scheduled_task_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[short_lived_windows_accounts_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[silentcleanup_uac_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[single_letter_process_on_endpoint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[spectre_and_meltdown_vulnerable_systems_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[spike_in_file_writes_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[splunk_enterprise_information_disclosure_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[spoolsv_spawning_rundll32_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[spoolsv_suspicious_loaded_modules_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[spoolsv_suspicious_process_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[spoolsv_writing_a_dll_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[spoolsv_writing_a_dll___sysmon_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[sqlite_module_in_temp_folder_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[start_up_during_safe_mode_boot_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[sunburst_correlation_dll_and_network_event_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[supernova_webshell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_changes_to_file_associations_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_computer_account_name_change_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_copy_on_system32_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_curl_network_connection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_dllhost_no_command_line_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_driver_loaded_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_email___uba_anomaly_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_email_attachment_extensions_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_event_log_service_behavior_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_file_write_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_gpupdate_no_command_line_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_icedid_rundll32_cmdline_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_image_creation_in_appdata_folder_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_java_classes_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_kerberos_service_ticket_request_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_linux_discovery_commands_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_msbuild_rename_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_msbuild_spawn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_plistbuddy_usage_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_plistbuddy_usage_via_osquery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_process_dns_query_known_abuse_web_services_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_process_file_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_process_with_discord_dns_query_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_reg_exe_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_regsvr32_register_suspicious_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_rundll32_plugininit_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_rundll32_rename_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_rundll32_startw_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_rundll32_dllregisterserver_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_rundll32_no_command_line_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_sqlite3_lsquarantine_behavior_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_scheduled_task_from_public_directory_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_searchprotocolhost_no_command_line_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_ticket_granting_ticket_request_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_wav_file_in_appdata_folder_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_microsoft_workflow_compiler_rename_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_microsoft_workflow_compiler_usage_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_msbuild_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_mshta_child_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_mshta_spawn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_wevtutil_usage_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_writes_to_system_volume_information_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[suspicious_writes_to_windows_recycle_bin_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[svchost_lolbas_execution_process_spawn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[system_info_gathering_using_dxdiag_application_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[system_information_discovery_detection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[system_processes_run_from_unexpected_locations_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[system_user_discovery_with_query_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[system_user_discovery_with_whoami_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[systems_ready_for_spectre_meltdown_windows_patch_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[tor_traffic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[time_provider_persistence_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[trickbot_named_pipe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[uac_bypass_mmc_load_unsigned_dll_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[uac_bypass_with_colorui_com_object_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[usn_journal_deletion_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[uncommon_processes_on_endpoint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[unified_messaging_service_spawning_a_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[uninstall_app_using_msiexec_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[unload_sysmon_filter_driver_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[unloading_amsi_via_reflection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[unsigned_image_loaded_by_lsass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[unsuccessful_netbackup_backups_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[unusual_number_of_computer_service_tickets_requested_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[unusual_number_of_kerberos_service_tickets_requested_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[unusual_number_of_remote_endpoint_authentication_events_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[unusually_long_command_line_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[unusually_long_command_line___mltk_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[unusually_long_content_type_length_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[update_previously_seen_users_in_cloudtrail_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[user_discovery_with_env_vars_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[user_discovery_with_env_vars_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[vbscript_execution_using_wscript_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[verclsid_clsid_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[w3wp_spawning_shell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[wbadmin_delete_system_backups_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[wmi_permanent_event_subscription_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[wmi_permanent_event_subscription___sysmon_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[wmi_recon_running_process_or_services_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[wmi_temporary_event_subscription_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[wmic_xsl_execution_via_url_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[wsreset_uac_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[wbemprox_com_object_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[web_fraud___account_harvesting_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[web_fraud___anomalous_user_clickspeed_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[web_fraud___password_sharing_across_accounts_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[web_servers_executing_suspicious_processes_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[wermgr_process_connecting_to_ip_check_web_services_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[wermgr_process_create_executable_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[wermgr_process_spawned_cmd_or_powershell_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[wget_download_and_bash_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[winevent_scheduled_task_created_within_public_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[winevent_scheduled_task_created_to_spawn_shell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[winevent_windows_task_scheduler_event_action_started_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[winrm_spawning_a_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_adfind_exe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_curl_download_to_suspicious_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_curl_upload_to_remote_destination_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_dism_remove_defender_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_defender_exclusion_registry_entry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_disable_memory_crash_dump_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_disableantispyware_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_diskcryptor_usage_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_diskshadow_proxy_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_dotnet_binary_in_non_standard_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_event_for_service_disabled_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_event_log_cleared_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_excessive_disabled_services_event_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_file_without_extension_in_critical_folder_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_high_file_deletion_frequency_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_hunting_system_account_targeting_lsass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_indirect_command_execution_via_forfiles_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_indirect_command_execution_via_pcalua_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_installutil_credential_theft_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_installutil_remote_network_connection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_installutil_url_in_command_line_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_installutil_uninstall_option_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_installutil_uninstall_option_with_network_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_installutil_in_non_standard_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_java_spawning_shells_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_modify_show_compress_color_and_info_tip_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_nirsoft_advancedrun_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_nirsoft_utilities_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_non_system_account_targeting_lsass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_possible_credential_dumping_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_process_with_namedpipe_commandline_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_raccine_scheduled_task_deletion_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_rasautou_dll_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_raw_access_to_disk_volume_partition_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_raw_access_to_master_boot_record_drive_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_remote_assistance_spawning_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_schtasks_create_run_as_system_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_security_account_manager_stopped_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_service_created_with_suspicious_service_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_service_created_within_public_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_service_creation_using_registry_entry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_service_creation_on_remote_endpoint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_service_initiation_on_remote_endpoint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_updates_install_failures_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_updates_install_successes_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_wmi_process_call_create_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_connhost_exe_started_forcefully_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[windows_hosts_file_modification_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[winhlp32_spawning_a_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[winword_spawning_cmd_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[winword_spawning_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[winword_spawning_windows_script_host_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[wmic_group_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[wmic_noninteractive_app_uninstallation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[wmiprsve_lolbas_execution_process_spawn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[wscript_or_cscript_suspicious_child_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[wsmprovhost_lolbas_execution_process_spawn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[xmrig_driver_loaded_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[xsl_script_execution_with_wmic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_detect_attach_to_role_policy_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_detect_permanent_key_creation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_detect_role_creation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_detect_sts_assume_role_abuse_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[aws_detect_sts_get_session_token_abuse_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[gcp_detect_oauth_token_abuse_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+

From 8194ebd1c09e59495a23bc4faf92e4dd34c8d3d9 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 25 Mar 2022 13:41:51 -0700
Subject: [PATCH 08/20] Added missing asset_types and fixed incorrect risk
 scores.  Risk score was not a product of Impact and Confidence.

---
 .../windows_indirect_command_execution_via_forfiles.yml      | 5 +++--
 .../windows_indirect_command_execution_via_pcalua.yml        | 5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
index 9cd2a9c615..bea3804da5 100644
--- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
+++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
@@ -53,7 +53,7 @@ tags:
   impact: 50
   confidence: 50 
   # (impact * confidence)/100
-  risk_score: 50
+  risk_score: 25
   context: 
   - Source:Endpoint
   - Stage:Defense Evasion
@@ -67,4 +67,5 @@ tags:
   - DE.AE
   cis20:
   - CIS 8
-  - CIS 10 
\ No newline at end of file
+  - CIS 10 
+  asset_type: Endpoint
\ No newline at end of file
diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
index 608929175e..159bf40355 100644
--- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
+++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
@@ -53,7 +53,7 @@ tags:
   impact: 50
   confidence: 50 
   # (impact * confidence)/100
-  risk_score: 50
+  risk_score: 25
   context: 
   - Source:Endpoint
   - Stage:Defense Evasion
@@ -67,4 +67,5 @@ tags:
   - DE.AE
   cis20:
   - CIS 8
-  - CIS 10 
\ No newline at end of file
+  - CIS 10 
+  asset_type: Endpoint
\ No newline at end of file

From bd47446ef89f0486c662f03f7bcf84feb858787c Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 25 Mar 2022 14:47:55 -0700
Subject: [PATCH 09/20] Updated with correct dataset paths

---
 .../windows_indirect_command_execution_via_forfiles.test.yml    | 2 +-
 .../windows_indirect_command_execution_via_pcalua.test.yml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml b/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml
index 0cb28311cf..20467cb95d 100644
--- a/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml
+++ b/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml
@@ -7,6 +7,6 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/InDirectToVideoData/master/datasets/T1202/atomic_red_team/windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/InDirectToVideo/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml b/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml
index d8a12ad6bd..980cf02d28 100644
--- a/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml
+++ b/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml
@@ -7,6 +7,6 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/InDirectToVideoData/datasets/T1202/atomic_red_team/windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/InDirectToVideo/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
\ No newline at end of file

From ce549174f681aedd0f82582a590e82336f2bdf9b Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 28 Mar 2022 15:20:26 -0700
Subject: [PATCH 10/20] Fixed detection name referenced in tests

---
 .../windows_indirect_command_execution_via_forfiles.test.yml    | 2 +-
 .../windows_indirect_command_execution_via_pcalua.test.yml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml b/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml
index 20467cb95d..f103195c97 100644
--- a/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml
+++ b/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml
@@ -1,7 +1,7 @@
 name: Windows Indirect Command Execution via forfiles Unit Test
 tests:
 - name: Windows Indirect Command Excecution via forfiles
-  file: endpoint/windows_indirect_command_execution.yml
+  file: endpoint/windows_indirect_command_execution_via_forfiles.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
diff --git a/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml b/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml
index 980cf02d28..dcd72d6166 100644
--- a/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml
+++ b/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml
@@ -1,7 +1,7 @@
 name: Windows Indirect Command Execution Via pcalua Unit Test
 tests:
 - name: Windows Indirect Command Excecution via pcalua
-  file: endpoint/windows_indirect_command_execution.yml
+  file: endpoint/windows_indirect_command_execution_via_pcalua.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

From 2d2fdb6be08f63b6abe983513a0f77b05c408db6 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 5 Apr 2022 10:05:21 -0700
Subject: [PATCH 11/20] Update
 windows_indirect_command_execution_via_pcalua.yml

Updated description in YML
---
 ...dows_indirect_command_execution_via_pcalua.yml | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
index 159bf40355..44cf06eb3b 100644
--- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
+++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
@@ -1,13 +1,15 @@
 name: Windows Indirect Command Execution Via pcalua
 id: 59e54602-9680-11ec-a8a6-aaaaaaaaaaaa
 version: 1
-date: '2022-03-09'
+date: '2022-04-05'
 author: Eric McGinnis, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic detection programs that have been started by pcalua.exe, forfiles, forfiles.exe, or conhost.exe.  
-  While these tools can be used to start legitimate programs, they have been observed being evade protections on command line execution.
+description: The following analytic detects programs that have been started by pcalua.exe.  
+  pcalua.exe is the Microsoft Windows Program Compatability Assistant.  While this tool 
+  can be used to start legitimate programs, it has been observed being used to evade 
+  protections on command line execution.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
     as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*pcalua* -a*"  
     by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_path
@@ -17,9 +19,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the full process path in the process field of CIM's Process data model.
   If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-  Tune and filter known instances where renamed forfiles.exe and pcalua.exe may be used.
-known_false_positives: Some legacy applications may be run using pcalua.exe.  
-  Similarly, forfiles.exe may be used in legitimate batch scripts.  Filter these results as needed.  
+  Tune and filter known instances where pcalua.exe may be used.
+known_false_positives: Some legacy applications may be run using pcalua.exe.  Filter these results as needed.  
 references:
   - https://twitter.com/KyleHanslovan/status/912659279806640128
   - REF2 - FIND ANOTHER REFERENCE
@@ -68,4 +69,4 @@ tags:
   cis20:
   - CIS 8
   - CIS 10 
-  asset_type: Endpoint
\ No newline at end of file
+  asset_type: Endpoint

From 90424b7e0c2921cfd65b304534c068a38c69aecc Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 5 Apr 2022 10:08:49 -0700
Subject: [PATCH 12/20] Update
 windows_indirect_command_execution_via_forfiles.yml

Updated description info on forfiles detection yaml
---
 ...ws_indirect_command_execution_via_forfiles.yml | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
index bea3804da5..cd14955bb3 100644
--- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
+++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
@@ -1,13 +1,16 @@
 name: Windows Indirect Command Execution Via forfiles
 id: 59e54602-9680-11ec-a8a6-aaaaaaaaaaaa
 version: 1
-date: '2022-03-09'
+date: '2022-04-05'
 author: Eric McGinnis, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic detection programs that have been started by pcalua.exe, forfiles, forfiles.exe, or conhost.exe.  
-  While these tools can be used to start legitimate programs, they have been observed being evade protections on command line execution.
+description: The following analytic detects programs that have been started by forfiles.exe.
+  According to Microsoft, the 'The forfiles command lets you run a command on or pass 
+  arguments to multiple files'. While this tool can be used to start legitimate programs,
+  usually within the context of a batch script, it has been observed being used to evade 
+  protections on command line execution.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
     as lastTime from datamodel=Endpoint.Processes where Processes.parent_process="*forfiles* /c *"  
     by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_path
@@ -17,12 +20,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the full process path in the process field of CIM's Process data model.
   If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-  Tune and filter known instances where renamed forfiles.exe and pcalua.exe may be used.
+  Tune and filter known instances where  forfiles.exe may be used.
 known_false_positives: Some legacy applications may be run using pcalua.exe.  
   Similarly, forfiles.exe may be used in legitimate batch scripts.  Filter these results as needed.  
 references:
   - https://twitter.com/KyleHanslovan/status/912659279806640128
-  - REF2 - FIND ANOTHER REFERENCE
+  - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/forfiles
 tags:
   analytic_story:
   - Living Off The Land
@@ -68,4 +71,4 @@ tags:
   cis20:
   - CIS 8
   - CIS 10 
-  asset_type: Endpoint
\ No newline at end of file
+  asset_type: Endpoint

From 71fe3edea735aef55a0d3d87eff961734f750e86 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 5 Apr 2022 10:12:45 -0700
Subject: [PATCH 13/20] Update
 windows_indirect_command_execution_via_forfiles.yml

Added UUID
---
 .../windows_indirect_command_execution_via_forfiles.yml         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
index cd14955bb3..73a3393133 100644
--- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
+++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
@@ -1,5 +1,5 @@
 name: Windows Indirect Command Execution Via forfiles
-id: 59e54602-9680-11ec-a8a6-aaaaaaaaaaaa
+id: 1fdf31c9-ff4d-4c48-b799-0e8666e08787
 version: 1
 date: '2022-04-05'
 author: Eric McGinnis, Splunk

From 0cde033ac12cf49544d597c677c2b0622eec52bf Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 5 Apr 2022 10:13:20 -0700
Subject: [PATCH 14/20] Update
 windows_indirect_command_execution_via_pcalua.yml

Added UUID
---
 .../endpoint/windows_indirect_command_execution_via_pcalua.yml  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
index 44cf06eb3b..d9246caf27 100644
--- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
+++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
@@ -1,5 +1,5 @@
 name: Windows Indirect Command Execution Via pcalua
-id: 59e54602-9680-11ec-a8a6-aaaaaaaaaaaa
+id: 3428ac18-a410-4823-816c-ce697d26f7a8
 version: 1
 date: '2022-04-05'
 author: Eric McGinnis, Splunk

From b385ef2ead5ccece5dbf1a2ec5ac35ee095d283e Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 5 Apr 2022 10:15:26 -0700
Subject: [PATCH 15/20] Update
 windows_indirect_command_execution_via_pcalua.yml

Adding second reference for pcalua.exe
---
 .../endpoint/windows_indirect_command_execution_via_pcalua.yml  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
index d9246caf27..f9988b8b03 100644
--- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
+++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
@@ -23,7 +23,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
 known_false_positives: Some legacy applications may be run using pcalua.exe.  Filter these results as needed.  
 references:
   - https://twitter.com/KyleHanslovan/status/912659279806640128
-  - REF2 - FIND ANOTHER REFERENCE
+  - https://lolbas-project.github.io/lolbas/Binaries/Pcalua/
 tags:
   analytic_story:
   - Living Off The Land

From 30ff35bcd8f7f3863d62954a86eae0a87d486a19 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 5 Apr 2022 10:20:58 -0700
Subject: [PATCH 16/20] Update
 windows_indirect_command_execution_via_pcalua.yml

Updated dataset link - need to update again after the dataset is merged from branch into main of attack_data
---
 .../endpoint/windows_indirect_command_execution_via_pcalua.yml  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
index f9988b8b03..0f139a0a7b 100644
--- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
+++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
@@ -28,7 +28,7 @@ tags:
   analytic_story:
   - Living Off The Land
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/InDirectToVideo/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:

From c7e1a0487379742e5b324df57dad9814e4da38e8 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 5 Apr 2022 10:21:42 -0700
Subject: [PATCH 17/20] Update
 windows_indirect_command_execution_via_forfiles.yml

Updated dataset.  Need to update again after dataset is merged from branch into main of attack_data
---
 .../windows_indirect_command_execution_via_forfiles.yml         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
index 73a3393133..56f8fd9b84 100644
--- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
+++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
@@ -30,7 +30,7 @@ tags:
   analytic_story:
   - Living Off The Land
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/InDirectToVideo/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:

From 9638205131eda63c84a85b48fd17fce1cc21c81e Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 5 Apr 2022 13:36:36 -0700
Subject: [PATCH 18/20] Fixed paths to attack data sets and updated
 required_fields format to matrch the rest of the detections in the repo.

---
 ...ndirect_command_execution_via_forfiles.yml | 24 +++++++++----------
 ..._indirect_command_execution_via_pcalua.yml | 24 +++++++++----------
 2 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
index 56f8fd9b84..557b7b6812 100644
--- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
+++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
@@ -30,7 +30,7 @@ tags:
   analytic_story:
   - Living Off The Land
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/InDirectToVideo/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -41,17 +41,17 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.user
-  - Endpoint.Processes.dest 
-  - Endpoint.Processes.user 
-  - Endpoint.Processes.parent_process 
-  - Endpoint.Processes.parent_process_name 
-  - Endpoint.Processes.process_name 
-  - Endpoint.Processes.process 
-  - Endpoint.Processes.process_id 
-  - Endpoint.Processes.parent_process_id 
-  - Endpoint.Processes.process_path
+  - Processes.dest
+  - Processes.user
+  - Processes.dest 
+  - Processes.user 
+  - Processes.parent_process 
+  - Processes.parent_process_name 
+  - Processes.process_name 
+  - Processes.process 
+  - Processes.process_id 
+  - Processes.parent_process_id 
+  - Processes.process_path
   security_domain: endpoint
   impact: 50
   confidence: 50 
diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
index 0f139a0a7b..6e29b08e87 100644
--- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
+++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml
@@ -28,7 +28,7 @@ tags:
   analytic_story:
   - Living Off The Land
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/InDirectToVideo/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -39,17 +39,17 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Endpoint.Processes.dest
-  - Endpoint.Processes.user
-  - Endpoint.Processes.dest 
-  - Endpoint.Processes.user 
-  - Endpoint.Processes.parent_process 
-  - Endpoint.Processes.parent_process_name 
-  - Endpoint.Processes.process_name 
-  - Endpoint.Processes.process 
-  - Endpoint.Processes.process_id 
-  - Endpoint.Processes.parent_process_id 
-  - Endpoint.Processes.process_path
+  - Processes.dest
+  - Processes.user
+  - Processes.dest 
+  - Processes.user 
+  - Processes.parent_process 
+  - Processes.parent_process_name 
+  - Processes.process_name 
+  - Processes.process 
+  - Processes.process_id 
+  - Processes.parent_process_id 
+  - Processes.process_path
   security_domain: endpoint
   impact: 50
   confidence: 50 

From fd5a14cae3257bd986f83286e8439bc56680cc3f Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 5 Apr 2022 13:37:51 -0700
Subject: [PATCH 19/20] Reverting changes that we made to the macros file.

---
 dist/escu/default/macros.conf | 7106 ++++++++++++++++-----------------
 1 file changed, 3357 insertions(+), 3749 deletions(-)

diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf
index 3d3cf545f9..e39489e852 100644
--- a/dist/escu/default/macros.conf
+++ b/dist/escu/default/macros.conf
@@ -1,10 +1,3358 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-03T18:16:55 UTC
+# On Date: 2022-04-04T18:01:09 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
 
+[splunk_dos_via_malformed_s2s_request_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[abnormally_high_number_of_cloud_infrastructure_api_calls_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[abnormally_high_number_of_cloud_security_group_api_calls_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_create_policy_version_to_allow_all_resources_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_createaccesskey_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_createloginprofile_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_cross_account_activity_from_previously_unseen_account_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_detect_users_with_kms_keys_performing_encryption_s3_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_ecr_container_scanning_findings_high_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_ecr_container_scanning_findings_low_informational_unknown_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_ecr_container_scanning_findings_medium_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_ecr_container_upload_outside_business_hours_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_ecr_container_upload_unknown_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_excessive_security_scanning_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_iam_accessdenied_discovery_events_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_iam_assume_role_policy_brute_force_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_iam_delete_policy_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_iam_failure_group_deletion_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_iam_successful_group_deletion_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_lambda_updatefunctioncode_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_network_access_control_list_created_with_all_open_ports_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_network_access_control_list_deleted_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_saml_access_by_provider_user_and_principal_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_saml_update_identity_provider_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_setdefaultpolicyversion_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_updateloginprofile_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[circle_ci_disable_security_job_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[circle_ci_disable_security_step_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[cloud_api_calls_from_previously_unseen_user_roles_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[cloud_compute_instance_created_by_previously_unseen_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[cloud_compute_instance_created_in_previously_unused_region_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[cloud_compute_instance_created_with_previously_unseen_image_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[cloud_compute_instance_created_with_previously_unseen_instance_type_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[cloud_instance_modified_by_previously_unseen_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[cloud_provisioning_activity_from_previously_unseen_city_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[cloud_provisioning_activity_from_previously_unseen_country_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[cloud_provisioning_activity_from_previously_unseen_ip_address_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[cloud_provisioning_activity_from_previously_unseen_region_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[correlation_by_repository_and_risk_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[correlation_by_user_and_risk_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_aws_console_login_by_new_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_aws_console_login_by_user_from_new_city_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_aws_console_login_by_user_from_new_country_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_aws_console_login_by_user_from_new_region_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_new_open_s3_buckets_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_new_open_s3_buckets_over_aws_cli_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_shared_ec2_snapshot_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[github_actions_disable_security_workflow_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[github_commit_changes_in_master_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[github_commit_in_develop_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[github_dependabot_alert_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[github_pull_request_from_unknown_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gsuite_drive_share_in_external_email_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gsuite_email_suspicious_attachment_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gsuite_email_suspicious_subject_with_attachment_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gsuite_email_with_known_abuse_web_service_link_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gsuite_outbound_email_with_attachment_to_external_domain_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gsuite_suspicious_shared_file_name_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_nginx_ingress_lfi_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_nginx_ingress_rfi_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_scanner_image_pulling_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[o365_add_app_role_assignment_grant_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[o365_added_service_principal_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[o365_bypass_mfa_via_trusted_ip_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[o365_disable_mfa_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[o365_excessive_authentication_failures_alert_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[o365_excessive_sso_logon_errors_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[o365_new_federated_domain_added_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[o365_pst_export_alert_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[o365_suspicious_admin_email_forwarding_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[o365_suspicious_rights_delegation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[o365_suspicious_user_email_forwarding_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[abnormally_high_aws_instances_launched_by_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[abnormally_high_aws_instances_launched_by_user___mltk_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[abnormally_high_aws_instances_terminated_by_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[abnormally_high_aws_instances_terminated_by_user___mltk_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_cloud_provisioning_from_previously_unseen_city_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_cloud_provisioning_from_previously_unseen_country_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_cloud_provisioning_from_previously_unseen_ip_address_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_cloud_provisioning_from_previously_unseen_region_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[clients_connecting_to_multiple_dns_servers_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[cloud_network_access_control_list_deleted_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_api_activity_from_users_without_mfa_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_aws_api_activities_from_unapproved_accounts_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_long_dns_txt_record_response_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_mimikatz_via_powershell_and_eventcode_4703_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_new_api_calls_from_user_roles_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_new_user_aws_console_login_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_spike_in_aws_api_activity_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_spike_in_network_acl_activity_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_spike_in_security_group_activity_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_usb_device_insertion_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_web_traffic_to_dynamic_domain_providers_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detection_of_dns_tunnels_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[dns_query_requests_resolved_by_unauthorized_dns_servers_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[dns_record_changed_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[dump_lsass_via_procdump_rename_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[ec2_instance_modified_with_previously_unseen_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[ec2_instance_started_in_previously_unseen_region_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[ec2_instance_started_with_previously_unseen_ami_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[ec2_instance_started_with_previously_unseen_instance_type_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[ec2_instance_started_with_previously_unseen_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[execution_of_file_with_spaces_before_extension_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[extended_period_without_successful_netbackup_backups_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[first_time_seen_command_line_argument_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gcp_detect_accounts_with_high_risk_roles_by_project_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gcp_detect_high_risk_permissions_by_resource_and_account_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gcp_detect_oauth_token_abuse_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gcp_gcr_container_uploaded_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gcp_kubernetes_cluster_scan_detection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[identify_new_user_accounts_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_aws_detect_most_active_service_accounts_by_pod_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_aws_detect_rbac_authorization_by_account_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_eks_kubernetes_cluster_sensitive_object_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_aws_detect_sensitive_role_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_aws_detect_service_accounts_forbidden_failure_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_azure_active_service_accounts_by_pod_namespace_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_azure_detect_rbac_authorization_by_account_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_azure_detect_sensitive_object_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_azure_detect_sensitive_role_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_azure_detect_suspicious_kubectl_calls_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_azure_pod_scan_fingerprint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_azure_scan_fingerprint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_gcp_detect_rbac_authorizations_by_account_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_gcp_detect_sensitive_object_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_gcp_detect_sensitive_role_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_gcp_detect_service_accounts_forbidden_failure_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_gcp_detect_suspicious_kubectl_calls_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[monitor_dns_for_brand_abuse_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[open_redirect_in_splunk_web_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[osquery_pack___coldroot_detection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[processes_created_by_netsh_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[prohibited_software_on_endpoint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[reg_exe_used_to_hide_files_directories_via_registry_keys_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[remote_registry_key_modifications_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[scheduled_tasks_used_in_badrabbit_ransomware_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[spectre_and_meltdown_vulnerable_systems_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[splunk_enterprise_information_disclosure_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_changes_to_file_associations_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_email___uba_anomaly_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_file_write_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_powershell_command_line_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_rundll32_rename_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_writes_to_system_volume_information_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[uncommon_processes_on_endpoint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[unsigned_image_loaded_by_lsass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[unsuccessful_netbackup_backups_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[web_fraud___account_harvesting_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[web_fraud___anomalous_user_clickspeed_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[web_fraud___password_sharing_across_accounts_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_connhost_exe_started_forcefully_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_hosts_file_modification_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[7zip_commandline_to_smb_share_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[access_lsass_memory_for_dump_creation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[account_discovery_with_net_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[active_setup_registry_autostart_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[add_defaultuser_and_password_in_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[add_or_set_windows_defender_exclusion_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[adsisearcher_account_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[allow_file_and_printing_sharing_in_firewall_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[allow_inbound_traffic_by_firewall_rule_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[allow_inbound_traffic_in_firewall_rule_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[allow_network_discovery_in_firewall_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[allow_operation_with_consent_admin_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[anomalous_usage_of_7zip_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[any_powershell_downloadfile_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[any_powershell_downloadstring_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[attacker_tools_on_endpoint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[attempt_to_add_certificate_to_untrusted_store_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[attempt_to_stop_security_service_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[attempted_credential_dump_from_registry_via_reg_exe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[auto_admin_logon_registry_entry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[batch_file_write_to_system32_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[bcdedit_command_back_to_normal_mode_boot_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[bcdedit_failure_recovery_modification_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[bits_job_persistence_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[bitsadmin_download_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[certutil_download_with_urlcache_and_split_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[certutil_download_with_verifyctl_and_split_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[certutil_exe_certificate_extraction_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[certutil_with_decode_argument_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[change_default_file_association_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[change_to_safe_mode_with_network_config_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[chcp_command_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[check_elevated_cmd_using_whoami_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[clear_unallocated_sector_using_cipher_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[clop_common_exec_parameter_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[clop_ransomware_known_service_name_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[cmd_carry_out_string_command_parameter_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[cmd_echo_pipe___escalation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[cmdline_tool_not_executed_in_cmd_shell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[cmlua_or_cmstplua_uac_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[cobalt_strike_named_pipes_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[common_ransomware_extensions_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[common_ransomware_notes_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[conti_common_exec_parameter_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[control_loading_from_world_writable_directory_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[create_local_admin_accounts_using_net_exe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[create_or_delete_windows_shares_using_net_exe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[create_remote_thread_in_shell_application_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[create_remote_thread_into_lsass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[creation_of_lsass_dump_with_taskmgr_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[creation_of_shadow_copy_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[creation_of_shadow_copy_with_wmic_and_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[credential_dumping_via_copy_command_from_shadow_copy_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[credential_dumping_via_symlink_to_shadow_copy_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[csc_net_on_the_fly_compilation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[curl_download_and_bash_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[delete_shadowcopy_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[deleting_of_net_users_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[deleting_shadow_copies_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_activity_related_to_pass_the_hash_attacks_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_azurehound_command_line_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_azurehound_file_modifications_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_copy_of_shadowcopy_with_script_block_logging_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_credential_dumping_through_lsass_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_empire_with_powershell_script_block_logging_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_excessive_account_lockouts_from_endpoint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_excessive_user_account_lockouts_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_exchange_web_shell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_html_help_renamed_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_html_help_spawn_child_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_html_help_url_in_command_line_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_html_help_using_infotech_storage_handlers_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_mimikatz_using_loaded_images_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_mimikatz_with_powershell_script_block_logging_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_mshta_inline_hta_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_mshta_renamed_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_mshta_url_in_command_line_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_new_local_admin_account_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_path_interception_by_creation_of_program_exe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_processes_used_for_system_network_configuration_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_prohibited_applications_spawning_cmd_exe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_psexec_with_accepteula_flag_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_rclone_command_line_usage_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_regasm_spawning_a_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_regasm_with_network_connection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_regasm_with_no_command_line_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_regsvcs_spawning_a_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_regsvcs_with_network_connection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_regsvcs_with_no_command_line_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_regsvr32_application_control_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_renamed_7_zip_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_renamed_psexec_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_renamed_rclone_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_renamed_winrar_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_rundll32_application_control_bypass___advpack_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_rundll32_application_control_bypass___setupapi_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_rundll32_application_control_bypass___syssetup_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_rundll32_inline_hta_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_sharphound_command_line_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_sharphound_file_modifications_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_sharphound_usage_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_use_of_cmd_exe_to_launch_script_interpreters_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_wmi_event_subscription_persistence_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disable_amsi_through_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disable_defender_antivirus_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disable_defender_blockatfirstseen_feature_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disable_defender_enhanced_notification_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disable_defender_mpengine_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disable_defender_spynet_reporting_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disable_defender_submit_samples_consent_feature_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disable_etw_through_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disable_logs_using_wevtutil_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disable_registry_tool_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disable_schedule_task_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disable_security_logs_using_minint_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disable_show_hidden_files_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disable_uac_remote_restriction_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disable_windows_app_hotkeys_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disable_windows_behavior_monitoring_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disable_windows_smartscreen_protection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disabled_kerberos_pre_authentication_discovery_with_powerview_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disabling_cmd_application_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disabling_controlpanel_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disabling_defender_services_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disabling_firewall_with_netsh_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disabling_folderoptions_windows_feature_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disabling_net_user_account_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disabling_norun_windows_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disabling_remote_user_account_control_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disabling_systemrestore_in_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[disabling_task_manager_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[dllhost_with_no_command_line_arguments_with_network_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[dns_exfiltration_using_nslookup_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[domain_account_discovery_with_dsquery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[domain_account_discovery_with_net_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[domain_account_discovery_with_wmic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[domain_controller_discovery_with_nltest_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[domain_controller_discovery_with_wmic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[domain_group_discovery_with_adsisearcher_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[domain_group_discovery_with_dsquery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[domain_group_discovery_with_net_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[domain_group_discovery_with_wmic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[download_files_using_telegram_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[drop_icedid_license_dat_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[dsquery_domain_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[dump_lsass_via_comsvcs_dll_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[dump_lsass_via_procdump_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[elevated_group_discovery_with_net_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[elevated_group_discovery_with_powerview_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[elevated_group_discovery_with_wmic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[enable_rdp_in_other_port_number_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[enable_wdigest_uselogoncredential_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[enumerate_users_local_group_using_telegram_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[esentutl_sam_copy_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[etw_registry_disabled_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[eventvwr_uac_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[excel_spawning_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[excel_spawning_windows_script_host_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[excessive_attempt_to_disable_services_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[excessive_distinct_processes_from_windows_temp_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[excessive_file_deletion_in_windefender_folder_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[excessive_number_of_service_control_start_as_disabled_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[excessive_number_of_taskhost_processes_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[excessive_service_stop_attempt_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[excessive_usage_of_cacls_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[excessive_usage_of_net_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[excessive_usage_of_nslookup_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[excessive_usage_of_sc_service_utility_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[excessive_usage_of_taskkill_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[executable_file_written_in_administrative_smb_share_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[executables_or_script_creation_in_suspicious_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[execute_javascript_with_jscript_com_clsid_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[execution_of_file_with_multiple_extensions_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[extraction_of_registry_hives_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[file_with_samsam_extension_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[firewall_allowed_program_enable_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[fodhelper_uac_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[fsutil_zeroing_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[get_addefaultdomainpasswordpolicy_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[get_aduser_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[get_aduser_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[get_aduserresultantpasswordpolicy_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[get_aduserresultantpasswordpolicy_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[get_domainpolicy_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[get_domainpolicy_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[get_domaintrust_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[get_domaintrust_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[get_domainuser_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[get_domainuser_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[get_foresttrust_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[get_foresttrust_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[get_wmiobject_group_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[get_wmiobject_group_discovery_with_script_block_logging_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getadcomputer_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getadcomputer_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getadgroup_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getadgroup_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getcurrent_user_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getcurrent_user_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getdomaincomputer_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getdomaincomputer_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getdomaincontroller_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getdomaincontroller_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getdomaingroup_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getdomaingroup_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getlocaluser_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getlocaluser_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getnettcpconnection_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getnettcpconnection_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getwmiobject_ds_computer_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getwmiobject_ds_computer_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getwmiobject_ds_group_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getwmiobject_ds_group_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getwmiobject_ds_user_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getwmiobject_ds_user_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getwmiobject_user_account_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[getwmiobject_user_account_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gpupdate_with_no_command_line_arguments_with_network_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[hide_user_account_from_sign_in_screen_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[hiding_files_and_directories_with_attrib_exe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[high_frequency_copy_of_files_in_network_share_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[high_process_termination_frequency_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[hunting_for_log4shell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[icacls_deny_command_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[icacls_grant_command_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[icedid_exfiltrated_archived_file_creation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[impacket_lateral_movement_commandline_parameters_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[interactive_session_on_remote_endpoint_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[java_class_file_download_by_java_user_agent_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[jscript_execution_using_cscript_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kerberoasting_spn_request_with_rc4_encryption_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kerberos_pre_authentication_flag_disabled_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[known_services_killed_by_ransomware_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_add_files_in_known_crontab_directories_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_add_user_account_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_at_allow_config_file_creation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_at_application_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_change_file_owner_to_root_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_common_process_for_elevation_control_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_dd_file_overwrite_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_doas_conf_file_creation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_doas_tool_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_edit_cron_table_parameter_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_file_created_in_kernel_driver_directory_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_file_creation_in_init_boot_directory_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_file_creation_in_profile_directory_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_insert_kernel_module_using_insmod_utility_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_install_kernel_module_using_modprobe_utility_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_java_spawning_shell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_nopasswd_entry_in_sudoers_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_pkexec_privilege_escalation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_possible_access_or_modification_of_sshd_config_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_possible_access_to_credential_files_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_possible_access_to_sudoers_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_possible_append_command_to_at_allow_config_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_possible_append_command_to_profile_config_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_possible_cronjob_modification_with_editor_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_possible_ssh_key_file_creation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_preload_hijack_library_calls_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_service_file_created_in_systemd_directory_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_service_restarted_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_service_started_or_enabled_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_setuid_using_chmod_utility_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_setuid_using_setcap_utility_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_sudo_or_su_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_sudoers_tmp_file_creation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_system_network_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[linux_visudo_utility_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[loading_of_dynwrapx_module_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[local_account_discovery_with_net_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[local_account_discovery_with_wmic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[log4shell_cve_2021_44228_exploitation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[logon_script_event_trigger_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[macos_lolbin_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[mailsniper_invoke_functions_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[malicious_inprocserver32_modification_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[malicious_powershell_executed_as_a_service_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[malicious_powershell_process___encoded_command_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[malicious_powershell_process___execution_policy_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[malicious_powershell_process_with_obfuscation_techniques_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[mimikatz_passtheticket_commandline_parameters_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[mmc_lolbas_execution_process_spawn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[modification_of_wallpaper_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[modify_acl_permission_to_files_or_folder_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[monitor_registry_keys_for_print_monitors_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[ms_scripting_process_loading_ldap_module_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[ms_scripting_process_loading_wmi_module_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[msbuild_suspicious_spawned_by_script_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[mshta_spawning_rundll32_or_regsvr32_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[mshtml_module_load_in_office_product_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[msi_module_loaded_by_non_system_binary_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[msmpeng_application_dll_side_loading_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[multiple_users_failing_to_authenticate_from_host_using_kerberos_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[multiple_users_failing_to_authenticate_from_host_using_ntlm_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[multiple_users_failing_to_authenticate_from_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[multiple_users_remotely_failing_to_authenticate_from_host_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[net_localgroup_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[net_profiler_uac_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[network_connection_discovery_with_arp_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[network_connection_discovery_with_net_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[network_connection_discovery_with_netstat_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[network_discovery_using_route_windows_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[nishang_powershelltcponeline_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[nltest_domain_trust_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[non_chrome_process_accessing_chrome_default_dir_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[non_firefox_process_access_firefox_profile_dir_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[ntdsutil_export_ntds_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[office_application_drop_executable_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[office_application_spawn_regsvr32_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[office_application_spawn_rundll32_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[office_document_creating_schedule_task_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[office_document_executing_macro_code_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[office_document_spawned_child_process_to_download_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[office_product_spawn_cmd_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[office_product_spawning_bitsadmin_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[office_product_spawning_certutil_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[office_product_spawning_mshta_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[office_product_spawning_rundll32_with_no_dll_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[office_product_spawning_wmic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[office_product_writing_cab_or_inf_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[office_spawning_control_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[outbound_network_connection_from_java_using_default_ports_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[overwriting_accessibility_binaries_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[password_policy_discovery_with_net_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[permission_modification_using_takeown_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[petitpotam_network_share_access_request_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[petitpotam_suspicious_kerberos_tgt_request_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[ping_sleep_batch_command_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[possible_browser_pass_view_parameter_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[possible_lateral_movement_powershell_spawn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[potentially_malicious_code_on_commandline_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[powershell_4104_hunting_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[powershell___connect_to_internet_with_hidden_window_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[powershell_creating_thread_mutex_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[powershell_disable_security_monitoring_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[powershell_domain_enumeration_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[powershell_enable_smb1protocol_feature_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[powershell_execute_com_object_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[powershell_fileless_process_injection_via_getprocaddress_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[powershell_fileless_script_contains_base64_encoded_content_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[powershell_get_localgroup_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[powershell_get_localgroup_discovery_with_script_block_logging_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[powershell_loading_dotnet_into_memory_via_reflection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[powershell_processing_stream_of_data_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[powershell_remote_thread_to_known_windows_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[powershell_remove_windows_defender_directory_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[powershell_start_bitstransfer_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[powershell_using_memory_as_backing_store_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[powershell_windows_defender_exclusion_commands_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[prevent_automatic_repair_mode_using_bcdedit_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[print_spooler_adding_a_printer_driver_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[print_spooler_failed_to_load_a_plug_in_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[process_creating_lnk_file_in_suspicious_location_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[process_deleting_its_process_file_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[process_execution_via_wmi_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[process_kill_base_on_file_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[process_writing_dynamicwrapperx_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[processes_launching_netsh_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[ransomware_notes_bulk_creation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[recon_avproduct_through_pwh_or_wmi_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[recon_using_wmi_class_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[recursive_delete_of_directory_in_batch_cmd_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[reg_exe_manipulating_windows_services_registry_keys_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[registry_keys_for_creating_shim_databases_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[registry_keys_used_for_persistence_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[registry_keys_used_for_privilege_escalation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[regsvr32_silent_and_install_param_dll_loading_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[regsvr32_with_known_silent_switch_cmdline_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[remcos_client_registry_install_entry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[remcos_rat_file_creation_in_remcos_folder_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[remote_process_instantiation_via_dcom_and_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[remote_process_instantiation_via_dcom_and_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[remote_process_instantiation_via_winrm_and_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[remote_process_instantiation_via_winrm_and_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[remote_process_instantiation_via_winrm_and_winrs_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[remote_process_instantiation_via_wmi_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[remote_process_instantiation_via_wmi_and_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[remote_process_instantiation_via_wmi_and_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[remote_system_discovery_with_adsisearcher_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[remote_system_discovery_with_dsquery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[remote_system_discovery_with_net_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[remote_system_discovery_with_wmic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[remote_wmi_command_attempt_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[resize_shadowstorage_volume_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[revil_common_exec_parameter_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[revil_registry_entry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[rubeus_command_line_parameters_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[rubeus_kerberos_ticket_exports_through_winlogon_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[runas_execution_in_commandline_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[rundll32_control_rundll_hunt_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[rundll32_control_rundll_world_writable_directory_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[rundll32_create_remote_thread_to_a_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[rundll32_createremotethread_in_browser_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[rundll32_dnsquery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[rundll32_process_creating_exe_dll_files_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[rundll32_shimcache_flush_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[rundll32_with_no_command_line_arguments_with_network_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[rundll_loading_dll_by_ordinal_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[ryuk_test_files_detected_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[ryuk_wake_on_lan_command_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[sam_database_file_access_attempt_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[samsam_test_file_write_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[sc_exe_manipulating_windows_services_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[schcache_change_by_app_connect_and_create_adsi_object_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[schedule_task_with_http_command_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[schedule_task_with_rundll32_command_trigger_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[scheduled_task_creation_on_remote_endpoint_using_at_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[scheduled_task_deleted_or_created_via_cmd_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[scheduled_task_initiation_on_remote_endpoint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[schtasks_run_task_on_demand_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[schtasks_scheduling_job_on_remote_system_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[schtasks_used_for_forcing_a_reboot_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[screensaver_event_trigger_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[script_execution_via_wmi_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[sdclt_uac_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[sdelete_application_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[searchprotocolhost_with_no_command_line_with_network_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[secretdumps_offline_ntds_dumping_tool_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[serviceprincipalnames_discovery_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[serviceprincipalnames_discovery_with_setspn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[services_escalate_exe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[services_lolbas_execution_process_spawn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[shim_database_file_creation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[shim_database_installation_with_suspicious_parameters_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[short_lived_scheduled_task_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[short_lived_windows_accounts_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[silentcleanup_uac_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[single_letter_process_on_endpoint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[slui_runas_elevated_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[slui_spawning_a_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[spoolsv_spawning_rundll32_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[spoolsv_suspicious_loaded_modules_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[spoolsv_suspicious_process_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[spoolsv_writing_a_dll_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[spoolsv_writing_a_dll___sysmon_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[sqlite_module_in_temp_folder_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[start_up_during_safe_mode_boot_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_computer_account_name_change_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_copy_on_system32_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_dllhost_no_command_line_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_driver_loaded_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_event_log_service_behavior_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_gpupdate_no_command_line_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_icedid_rundll32_cmdline_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_image_creation_in_appdata_folder_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_kerberos_service_ticket_request_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_linux_discovery_commands_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_microsoft_workflow_compiler_rename_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_microsoft_workflow_compiler_usage_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_msbuild_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_msbuild_rename_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_msbuild_spawn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_mshta_child_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_mshta_spawn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_process_dns_query_known_abuse_web_services_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_process_file_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_process_with_discord_dns_query_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_reg_exe_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_regsvr32_register_suspicious_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_rundll32_dllregisterserver_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_rundll32_plugininit_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_rundll32_startw_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_rundll32_no_command_line_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_scheduled_task_from_public_directory_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_searchprotocolhost_no_command_line_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_ticket_granting_ticket_request_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_wav_file_in_appdata_folder_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_wevtutil_usage_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_writes_to_windows_recycle_bin_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[svchost_lolbas_execution_process_spawn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[system_info_gathering_using_dxdiag_application_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[system_information_discovery_detection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[system_processes_run_from_unexpected_locations_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[system_user_discovery_with_query_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[system_user_discovery_with_whoami_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[time_provider_persistence_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[trickbot_named_pipe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[uac_bypass_mmc_load_unsigned_dll_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[uac_bypass_with_colorui_com_object_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[unified_messaging_service_spawning_a_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[uninstall_app_using_msiexec_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[unload_sysmon_filter_driver_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[unloading_amsi_via_reflection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[unusual_number_of_kerberos_service_tickets_requested_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[user_discovery_with_env_vars_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[user_discovery_with_env_vars_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[usn_journal_deletion_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[vbscript_execution_using_wscript_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[verclsid_clsid_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[w3wp_spawning_shell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[wbadmin_delete_system_backups_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[wbemprox_com_object_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[wermgr_process_connecting_to_ip_check_web_services_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[wermgr_process_create_executable_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[wermgr_process_spawned_cmd_or_powershell_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[wget_download_and_bash_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_adfind_exe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_curl_download_to_suspicious_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_curl_upload_to_remote_destination_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_defender_exclusion_registry_entry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_deleted_registry_by_a_non_critical_process_file_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_disable_change_password_through_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_disable_lock_workstation_feature_through_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_disable_logoff_button_through_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_disable_memory_crash_dump_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_disable_notification_center_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_disable_shutdown_button_through_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_disable_windows_group_policy_features_through_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_disableantispyware_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_disabled_users_failing_to_authenticate_kerberos_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_diskcryptor_usage_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_diskshadow_proxy_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_dism_remove_defender_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_dotnet_binary_in_non_standard_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_event_for_service_disabled_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_event_log_cleared_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_excessive_disabled_services_event_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_file_without_extension_in_critical_folder_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_hide_notification_features_through_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_high_file_deletion_frequency_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_hunting_system_account_targeting_lsass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_installutil_credential_theft_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_installutil_in_non_standard_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_installutil_remote_network_connection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_installutil_uninstall_option_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_installutil_uninstall_option_with_network_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_installutil_url_in_command_line_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_invalid_users_failed_authentication_via_kerberos_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_modify_show_compress_color_and_info_tip_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_nirsoft_advancedrun_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_nirsoft_utilities_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_non_system_account_targeting_lsass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_possible_credential_dumping_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_process_with_namedpipe_commandline_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_raccine_scheduled_task_deletion_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_rasautou_dll_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_raw_access_to_disk_volume_partition_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_raw_access_to_master_boot_record_drive_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_remote_assistance_spawning_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_schtasks_create_run_as_system_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_security_account_manager_stopped_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_service_created_with_suspicious_service_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_service_created_within_public_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_service_creation_on_remote_endpoint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_service_creation_using_registry_entry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_service_initiation_on_remote_endpoint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_terminating_lsass_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_users_authenticate_using_explicit_credentials_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_wmi_process_call_create_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[winevent_scheduled_task_created_to_spawn_shell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[winevent_scheduled_task_created_within_public_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[winevent_windows_task_scheduler_event_action_started_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[winhlp32_spawning_a_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[winword_spawning_cmd_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[winword_spawning_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[winword_spawning_windows_script_host_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[wmi_permanent_event_subscription___sysmon_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[wmi_recon_running_process_or_services_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[wmic_group_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[wmic_noninteractive_app_uninstallation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[wmic_xsl_execution_via_url_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[wmiprsve_lolbas_execution_process_spawn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[wscript_or_cscript_suspicious_child_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[wsmprovhost_lolbas_execution_process_spawn_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[wsreset_uac_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[xmrig_driver_loaded_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[xsl_script_execution_with_wmic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_new_login_attempts_to_routers_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[email_attachments_with_lots_of_spaces_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[email_files_written_outside_of_the_outlook_directory_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[email_servers_sending_high_volume_traffic_to_hosts_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[monitor_email_for_brand_abuse_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[no_windows_updates_in_a_time_frame_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[okta_account_lockout_events_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[okta_failed_sso_attempts_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[okta_user_logins_from_multiple_cities_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_email_attachment_extensions_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_java_classes_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[web_servers_executing_suspicious_processes_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[abnormally_high_number_of_cloud_instances_destroyed_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[abnormally_high_number_of_cloud_instances_launched_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[amazon_eks_kubernetes_cluster_scan_detection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[amazon_eks_kubernetes_pod_scan_detection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_detect_attach_to_role_policy_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_detect_permanent_key_creation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_detect_role_creation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_detect_sts_assume_role_abuse_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[aws_detect_sts_get_session_token_abuse_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_gcp_storage_access_from_a_new_ip_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_new_open_gcp_storage_buckets_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_s3_access_from_a_new_ip_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_spike_in_aws_security_hub_alerts_for_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_spike_in_blocked_outbound_traffic_from_your_aws_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_spike_in_s3_bucket_deletion_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gcp_detect_gcploit_framework_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gcp_kubernetes_cluster_pod_scan_detection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gdrive_suspicious_file_sharing_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[gsuite_suspicious_calendar_invite_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[high_number_of_login_failures_from_a_single_source_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[kubernetes_aws_detect_suspicious_kubectl_calls_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[new_container_uploaded_to_aws_ecr_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[child_processes_of_spoolsv_exe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_baron_samedit_cve_2021_3156_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_baron_samedit_cve_2021_3156_segfault_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_baron_samedit_cve_2021_3156_via_osquery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_computer_changed_with_anonymous_account_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_outlook_exe_writing_a_zip_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_rare_executables_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detection_of_tools_built_by_nirsoft_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[exchange_powershell_abuse_via_ssrf_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[exchange_powershell_module_usage_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[first_time_seen_child_process_of_zoom_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[first_time_seen_running_windows_service_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[macos___re_opened_applications_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[ms_exchange_mailbox_replication_service_writing_active_server_pages_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[print_processor_registry_autostart_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[processes_tapping_keyboard_events_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[randomly_generated_scheduled_task_name_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[randomly_generated_windows_service_name_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[remote_desktop_process_running_on_system_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[spike_in_file_writes_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[sunburst_correlation_dll_and_network_event_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_curl_network_connection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_plistbuddy_usage_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_plistbuddy_usage_via_osquery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[suspicious_sqlite3_lsquarantine_behavior_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[unusual_number_of_computer_service_tickets_requested_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[unusual_number_of_remote_endpoint_authentication_events_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[unusually_long_command_line_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[unusually_long_command_line___mltk_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_java_spawning_shells_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[winrm_spawning_a_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[wmi_permanent_event_subscription_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[wmi_temporary_event_subscription_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_arp_poisoning_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_ipv6_network_infrastructure_threats_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_large_outbound_icmp_packets_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_outbound_smb_traffic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_port_security_violation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_rogue_dhcp_server_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_snicat_sni_exfiltration_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_software_download_to_network_device_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_traffic_mirroring_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_unauthorized_assets_by_mac_address_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_windows_dns_sigred_via_splunk_stream_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_windows_dns_sigred_via_zeek_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_zerologon_via_zeek_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[dns_query_length_outliers___mltk_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[excessive_dns_failures_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[hosts_receiving_high_volume_of_network_traffic_from_email_server_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[large_volume_of_dns_any_queries_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[prohibited_network_traffic_allowed_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[protocol_or_port_mismatch_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[protocols_passing_authentication_in_cleartext_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[remote_desktop_network_bruteforce_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[remote_desktop_network_traffic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[smb_traffic_spike_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[smb_traffic_spike___mltk_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[tor_traffic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[unusually_long_content_type_length_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_attackers_scanning_for_vulnerable_jboss_servers_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_f5_tmui_rce_cve_2020_5902_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_malicious_requests_to_exploit_jboss_servers_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[monitor_web_traffic_for_brand_abuse_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[sql_injection_with_long_urls_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[supernova_webshell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_hosts_connecting_to_dynamic_domain_providers_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[detect_outbound_ldap_traffic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[dns_query_length_with_high_standard_deviation_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[multiple_archive_files_http_post_traffic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[plain_http_post_exfiltrated_data_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[log4shell_jndi_payload_injection_attempt_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[log4shell_jndi_payload_injection_with_outbound_connection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 
 [aws_cloudwatchlogs_eks]
 definition = sourcetype="aws:cloudwatchlogs:eks"
@@ -206,6 +3554,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = eventtype=okta_log
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
 
+[osquery]
+definition = sourcetype=osquery:results
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
 [osquery_process]
 definition = eventtype="osquery-process"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
@@ -487,6 +3839,10 @@ description = This macro is a list of AWS event names associated with security g
 definition = index=signals
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
 
+[splunkd]
+definition = index=_internal sourcetype=splunkd
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
 [stream_dns]
 definition = sourcetype=stream:dns
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
@@ -547,3751 +3903,3 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = index=zeek sourcetype="zeek:ssl:json"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
 
-[7zip_commandline_to_smb_share_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_cloud_provisioning_from_previously_unseen_city_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_cloud_provisioning_from_previously_unseen_country_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_cloud_provisioning_from_previously_unseen_ip_address_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_cloud_provisioning_from_previously_unseen_region_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_create_policy_version_to_allow_all_resources_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_createaccesskey_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_createloginprofile_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_cross_account_activity_from_previously_unseen_account_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_detect_users_with_kms_keys_performing_encryption_s3_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_ecr_container_scanning_findings_high_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_ecr_container_scanning_findings_low_informational_unknown_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_ecr_container_scanning_findings_medium_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_ecr_container_upload_outside_business_hours_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_ecr_container_upload_unknown_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_eks_kubernetes_cluster_sensitive_object_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_excessive_security_scanning_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_iam_accessdenied_discovery_events_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_iam_assume_role_policy_brute_force_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_iam_delete_policy_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_iam_failure_group_deletion_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_iam_successful_group_deletion_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_investigate_security_hub_alerts_by_dest_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_investigate_user_activities_by_arn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_investigate_user_activities_by_accesskeyid_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_lambda_updatefunctioncode_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_network_acl_details_from_id_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_network_access_control_list_created_with_all_open_ports_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_network_access_control_list_deleted_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_network_interface_details_via_resourceid_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_s3_bucket_details_via_bucketname_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_saml_access_by_provider_user_and_principal_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_saml_update_identity_provider_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_setdefaultpolicyversion_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_updateloginprofile_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[abnormally_high_aws_instances_launched_by_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[abnormally_high_aws_instances_launched_by_user___mltk_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[abnormally_high_aws_instances_terminated_by_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[abnormally_high_aws_instances_terminated_by_user___mltk_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[abnormally_high_number_of_cloud_infrastructure_api_calls_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[abnormally_high_number_of_cloud_instances_destroyed_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[abnormally_high_number_of_cloud_instances_launched_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[abnormally_high_number_of_cloud_security_group_api_calls_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[access_lsass_memory_for_dump_creation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[account_discovery_with_net_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[active_setup_registry_autostart_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[add_defaultuser_and_password_in_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[add_prohibited_processes_to_enterprise_security_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[add_or_set_windows_defender_exclusion_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[adsisearcher_account_discovery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[all_backup_logs_for_host_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[allow_file_and_printing_sharing_in_firewall_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[allow_inbound_traffic_by_firewall_rule_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[allow_inbound_traffic_in_firewall_rule_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[allow_network_discovery_in_firewall_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[allow_operation_with_consent_admin_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[amazon_eks_kubernetes_pod_scan_detection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[amazon_eks_kubernetes_activity_by_src_ip_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[amazon_eks_kubernetes_cluster_scan_detection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[anomalous_usage_of_7zip_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[any_powershell_downloadfile_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[any_powershell_downloadstring_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[attacker_tools_on_endpoint_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[attempt_to_add_certificate_to_untrusted_store_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[attempt_to_stop_security_service_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[attempted_credential_dump_from_registry_via_reg_exe_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[auto_admin_logon_registry_entry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[bcdedit_failure_recovery_modification_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[bits_job_persistence_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[bitsadmin_download_file_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[baseline_of_cloud_infrastructure_api_calls_per_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[baseline_of_cloud_instances_destroyed_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[baseline_of_cloud_instances_launched_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[baseline_of_cloud_security_group_api_calls_per_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[baseline_of_api_calls_per_user_arn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[baseline_of_command_line_length___mltk_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[baseline_of_dns_query_length___mltk_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[baseline_of_excessive_aws_instances_launched_by_user___mltk_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[baseline_of_excessive_aws_instances_terminated_by_user___mltk_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[baseline_of_network_acl_activity_by_arn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[baseline_of_s3_bucket_deletion_activity_by_arn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[baseline_of_smb_traffic___mltk_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[baseline_of_security_group_activity_by_arn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[baseline_of_blocked_outbound_traffic_from_aws_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[batch_file_write_to_system32_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[bcdedit_command_back_to_normal_mode_boot_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[chcp_command_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[cmd_carry_out_string_command_parameter_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[cmd_echo_pipe___escalation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[cmlua_or_cmstplua_uac_bypass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[csc_net_on_the_fly_compilation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[certutil_download_with_urlcache_and_split_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[certutil_download_with_verifyctl_and_split_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[certutil_with_decode_argument_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[certutil_exe_certificate_extraction_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[change_default_file_association_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[change_to_safe_mode_with_network_config_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[check_elevated_cmd_using_whoami_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[child_processes_of_spoolsv_exe_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[circle_ci_disable_security_job_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[circle_ci_disable_security_step_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[clear_unallocated_sector_using_cipher_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[clients_connecting_to_multiple_dns_servers_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[clop_common_exec_parameter_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[clop_ransomware_known_service_name_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[cloud_api_calls_from_previously_unseen_user_roles_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[cloud_compute_instance_created_by_previously_unseen_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[cloud_compute_instance_created_in_previously_unused_region_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[cloud_compute_instance_created_with_previously_unseen_image_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[cloud_compute_instance_created_with_previously_unseen_instance_type_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[cloud_instance_modified_by_previously_unseen_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[cloud_network_access_control_list_deleted_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[cloud_provisioning_activity_from_previously_unseen_city_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[cloud_provisioning_activity_from_previously_unseen_country_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[cloud_provisioning_activity_from_previously_unseen_ip_address_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[cloud_provisioning_activity_from_previously_unseen_region_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[cmdline_tool_not_executed_in_cmd_shell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[cobalt_strike_named_pipes_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[common_ransomware_extensions_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[common_ransomware_notes_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[conti_common_exec_parameter_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[control_loading_from_world_writable_directory_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[correlation_by_repository_and_risk_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[correlation_by_user_and_risk_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[count_of_unique_ips_connecting_to_ports_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[count_of_assets_by_category_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[create_remote_thread_in_shell_application_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[create_remote_thread_into_lsass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[create_a_list_of_approved_aws_service_accounts_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[create_local_admin_accounts_using_net_exe_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[create_or_delete_windows_shares_using_net_exe_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[creation_of_shadow_copy_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[creation_of_shadow_copy_with_wmic_and_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[creation_of_lsass_dump_with_taskmgr_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[credential_dumping_via_copy_command_from_shadow_copy_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[credential_dumping_via_symlink_to_shadow_copy_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[curl_download_and_bash_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[dllhost_with_no_command_line_arguments_with_network_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[dns_exfiltration_using_nslookup_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[dns_query_length_outliers___mltk_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[dns_query_length_with_high_standard_deviation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[dns_query_requests_resolved_by_unauthorized_dns_servers_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[dns_record_changed_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[dnstwist_domain_names_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[dsquery_domain_discovery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[delete_shadowcopy_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[deleting_of_net_users_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[deleting_shadow_copies_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_api_activity_from_users_without_mfa_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_arp_poisoning_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_aws_api_activities_from_unapproved_accounts_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_aws_console_login_by_new_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_aws_console_login_by_user_from_new_city_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_aws_console_login_by_user_from_new_country_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_aws_console_login_by_user_from_new_region_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_activity_related_to_pass_the_hash_attacks_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_azurehound_command_line_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_azurehound_file_modifications_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_baron_samedit_cve_2021_3156_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_baron_samedit_cve_2021_3156_segfault_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_baron_samedit_cve_2021_3156_via_osquery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_computer_changed_with_anonymous_account_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_copy_of_shadowcopy_with_script_block_logging_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_credential_dumping_through_lsass_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_empire_with_powershell_script_block_logging_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_excessive_account_lockouts_from_endpoint_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_excessive_user_account_lockouts_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_exchange_web_shell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_f5_tmui_rce_cve_2020_5902_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_gcp_storage_access_from_a_new_ip_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_html_help_renamed_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_html_help_spawn_child_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_html_help_url_in_command_line_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_html_help_using_infotech_storage_handlers_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_ipv6_network_infrastructure_threats_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_large_outbound_icmp_packets_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_long_dns_txt_record_response_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_mshta_url_in_command_line_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_mimikatz_using_loaded_images_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_mimikatz_via_powershell_and_eventcode_4703_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_mimikatz_with_powershell_script_block_logging_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_new_local_admin_account_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_new_login_attempts_to_routers_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_new_open_gcp_storage_buckets_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_new_open_s3_buckets_over_aws_cli_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_new_open_s3_buckets_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_outbound_ldap_traffic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_outbound_smb_traffic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_outlook_exe_writing_a_zip_file_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_path_interception_by_creation_of_program_exe_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_port_security_violation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_prohibited_applications_spawning_cmd_exe_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_psexec_with_accepteula_flag_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_rclone_command_line_usage_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_rare_executables_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_regasm_spawning_a_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_regasm_with_network_connection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_regasm_with_no_command_line_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_regsvcs_spawning_a_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_regsvcs_with_network_connection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_regsvcs_with_no_command_line_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_regsvr32_application_control_bypass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_renamed_7_zip_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_renamed_psexec_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_renamed_rclone_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_renamed_winrar_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_rogue_dhcp_server_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_rundll32_application_control_bypass___advpack_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_rundll32_application_control_bypass___setupapi_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_rundll32_application_control_bypass___syssetup_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_rundll32_inline_hta_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_s3_access_from_a_new_ip_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_snicat_sni_exfiltration_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_sharphound_command_line_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_sharphound_file_modifications_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_sharphound_usage_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_software_download_to_network_device_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_spike_in_aws_api_activity_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_spike_in_aws_security_hub_alerts_for_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_spike_in_network_acl_activity_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_spike_in_s3_bucket_deletion_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_spike_in_security_group_activity_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_spike_in_blocked_outbound_traffic_from_your_aws_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_traffic_mirroring_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_usb_device_insertion_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_unauthorized_assets_by_mac_address_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_use_of_cmd_exe_to_launch_script_interpreters_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_wmi_event_subscription_persistence_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_windows_dns_sigred_via_splunk_stream_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_windows_dns_sigred_via_zeek_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_zerologon_via_zeek_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_attackers_scanning_for_vulnerable_jboss_servers_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_hosts_connecting_to_dynamic_domain_providers_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_malicious_requests_to_exploit_jboss_servers_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_mshta_inline_hta_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_mshta_renamed_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_new_api_calls_from_user_roles_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_new_user_aws_console_login_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_processes_used_for_system_network_configuration_discovery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_shared_ec2_snapshot_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detect_web_traffic_to_dynamic_domain_providers_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detection_of_dns_tunnels_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[detection_of_tools_built_by_nirsoft_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disable_amsi_through_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disable_defender_antivirus_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disable_defender_blockatfirstseen_feature_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disable_defender_enhanced_notification_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disable_defender_mpengine_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disable_defender_spynet_reporting_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disable_defender_submit_samples_consent_feature_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disable_etw_through_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disable_logs_using_wevtutil_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disable_registry_tool_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disable_schedule_task_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disable_security_logs_using_minint_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disable_show_hidden_files_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disable_uac_remote_restriction_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disable_windows_app_hotkeys_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disable_windows_behavior_monitoring_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disable_windows_smartscreen_protection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disabled_kerberos_pre_authentication_discovery_with_powerview_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disabling_cmd_application_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disabling_controlpanel_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disabling_defender_services_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disabling_firewall_with_netsh_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disabling_folderoptions_windows_feature_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disabling_net_user_account_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disabling_norun_windows_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disabling_remote_user_account_control_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disabling_systemrestore_in_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[disabling_task_manager_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[discover_dns_records_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[domain_account_discovery_with_net_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[domain_account_discovery_with_dsquery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[domain_account_discovery_with_wmic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[domain_controller_discovery_with_nltest_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[domain_controller_discovery_with_wmic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[domain_group_discovery_with_dsquery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[domain_group_discovery_with_net_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[domain_group_discovery_with_wmic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[domain_group_discovery_with_adsisearcher_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[download_files_using_telegram_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[drop_icedid_license_dat_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[dump_lsass_via_comsvcs_dll_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[dump_lsass_via_procdump_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[dump_lsass_via_procdump_rename_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[ec2_instance_modified_with_previously_unseen_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[ec2_instance_started_in_previously_unseen_region_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[ec2_instance_started_with_previously_unseen_ami_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[ec2_instance_started_with_previously_unseen_instance_type_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[ec2_instance_started_with_previously_unseen_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[etw_registry_disabled_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[elevated_group_discovery_with_net_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[elevated_group_discovery_with_wmic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[elevated_group_discovery_with_powerview_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[email_attachments_with_lots_of_spaces_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[email_files_written_outside_of_the_outlook_directory_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[email_servers_sending_high_volume_traffic_to_hosts_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[enable_rdp_in_other_port_number_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[enable_wdigest_uselogoncredential_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[enumerate_users_local_group_using_telegram_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[esentutl_sam_copy_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[eventvwr_uac_bypass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[excel_spawning_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[excel_spawning_windows_script_host_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[excessive_attempt_to_disable_services_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[excessive_dns_failures_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[excessive_file_deletion_in_windefender_folder_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[excessive_service_stop_attempt_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[excessive_usage_of_cacls_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[excessive_usage_of_net_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[excessive_usage_of_sc_service_utility_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[excessive_usage_of_taskkill_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[excessive_usage_of_nslookup_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[excessive_number_of_distinct_processes_created_in_windows_temp_folder_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[excessive_number_of_service_control_start_as_disabled_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[excessive_number_of_taskhost_processes_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[exchange_powershell_abuse_via_ssrf_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[exchange_powershell_module_usage_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[executable_file_written_in_administrative_smb_share_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[executables_or_script_creation_in_suspicious_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[execute_javascript_with_jscript_com_clsid_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[execution_of_file_with_spaces_before_extension_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[execution_of_file_with_multiple_extensions_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[extended_period_without_successful_netbackup_backups_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[extraction_of_registry_hives_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[file_with_samsam_extension_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[firewall_allowed_program_enable_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[first_time_seen_child_process_of_zoom_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[first_time_seen_running_windows_service_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[first_time_seen_command_line_argument_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[fodhelper_uac_bypass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[fsutil_zeroing_file_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[gcp_detect_accounts_with_high_risk_roles_by_project_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[gcp_detect_gcploit_framework_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[gcp_detect_high_risk_permissions_by_resource_and_account_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[gcp_gcr_container_uploaded_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[gcp_kubernetes_activity_by_src_ip_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[gcp_kubernetes_cluster_pod_scan_detection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[gcp_kubernetes_cluster_scan_detection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[gpupdate_with_no_command_line_arguments_with_network_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[gsuite_email_suspicious_attachment_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[gdrive_suspicious_file_sharing_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_addefaultdomainpasswordpolicy_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_aduser_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_aduser_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_aduserresultantpasswordpolicy_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_aduserresultantpasswordpolicy_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_all_aws_activity_from_city_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_all_aws_activity_from_country_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_all_aws_activity_from_ip_address_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_all_aws_activity_from_region_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_backup_logs_for_endpoint_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_certificate_logs_for_a_domain_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_dns_server_history_for_a_host_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_dns_traffic_ratio_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_domainpolicy_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_domainpolicy_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_domainuser_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_domainuser_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_ec2_instance_details_by_instanceid_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_ec2_launch_details_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_email_info_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_emails_from_specific_sender_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_first_occurrence_and_last_occurrence_of_a_mac_address_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_history_of_email_sources_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_logon_rights_modifications_for_endpoint_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_logon_rights_modifications_for_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_notable_history_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_outbound_emails_to_hidden_cobra_threat_actors_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_parent_process_info_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_process_file_activity_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_process_info_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_process_information_for_port_activity_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_process_responsible_for_the_dns_traffic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_sysmon_wmi_activity_for_host_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_wmiobject_group_discovery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_wmiobject_group_discovery_with_script_block_logging_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_web_session_information_via_session_id_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_domaintrust_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_domaintrust_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_foresttrust_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[get_foresttrust_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getadcomputer_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getadcomputer_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getadgroup_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getadgroup_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getcurrent_user_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getcurrent_user_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getdomaincomputer_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getdomaincomputer_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getdomaincontroller_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getdomaincontroller_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getdomaingroup_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getdomaingroup_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getlocaluser_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getlocaluser_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getnettcpconnection_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getnettcpconnection_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getwmiobject_ds_user_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getwmiobject_ds_user_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getwmiobject_ds_computer_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getwmiobject_ds_computer_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getwmiobject_ds_group_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getwmiobject_ds_group_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getwmiobject_user_account_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[getwmiobject_user_account_with_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[github_dependabot_alert_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[github_pull_request_from_unknown_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[github_commit_changes_in_master_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[github_commit_in_develop_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[gsuite_drive_share_in_external_email_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[gsuite_email_suspicious_subject_with_attachment_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[gsuite_email_with_known_abuse_web_service_link_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[gsuite_outbound_email_with_attachment_to_external_domain_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[gsuite_suspicious_shared_file_name_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[gsuite_suspicious_calendar_invite_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[hide_user_account_from_sign_in_screen_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[hiding_files_and_directories_with_attrib_exe_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[high_frequency_copy_of_files_in_network_share_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[high_number_of_login_failures_from_a_single_source_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[high_process_termination_frequency_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[hosts_receiving_high_volume_of_network_traffic_from_email_server_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[hunting_for_log4shell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[icacls_grant_command_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[icacls_deny_command_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[icedid_exfiltrated_archived_file_creation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[identify_new_user_accounts_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[identify_systems_creating_remote_desktop_traffic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[identify_systems_receiving_remote_desktop_traffic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[identify_systems_using_remote_desktop_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[impacket_lateral_movement_commandline_parameters_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[interactive_session_on_remote_endpoint_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[investigate_aws_user_activities_by_user_field_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[investigate_aws_activities_via_region_name_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[investigate_failed_logins_for_multiple_destinations_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[investigate_network_traffic_from_src_ip_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[investigate_okta_activity_by_ip_address_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[investigate_okta_activity_by_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[investigate_pass_the_hash_attempts_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[investigate_pass_the_ticket_attempts_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[investigate_previous_unseen_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[investigate_successful_remote_desktop_authentications_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[investigate_suspicious_strings_in_http_header_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[investigate_user_activities_in_okta_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[investigate_web_posts_from_src_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[java_class_file_download_by_java_user_agent_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[jscript_execution_using_cscript_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kerberoasting_spn_request_with_rc4_encryption_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kerberos_pre_authentication_flag_disabled_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[known_services_killed_by_ransomware_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kubernetes_aws_detect_rbac_authorization_by_account_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kubernetes_aws_detect_most_active_service_accounts_by_pod_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kubernetes_aws_detect_sensitive_role_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kubernetes_aws_detect_service_accounts_forbidden_failure_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kubernetes_aws_detect_suspicious_kubectl_calls_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kubernetes_azure_detect_rbac_authorization_by_account_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kubernetes_azure_detect_sensitive_object_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kubernetes_azure_detect_sensitive_role_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kubernetes_azure_detect_suspicious_kubectl_calls_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kubernetes_azure_pod_scan_fingerprint_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kubernetes_azure_scan_fingerprint_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kubernetes_gcp_detect_rbac_authorizations_by_account_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kubernetes_gcp_detect_sensitive_object_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kubernetes_gcp_detect_sensitive_role_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kubernetes_gcp_detect_service_accounts_forbidden_failure_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kubernetes_gcp_detect_suspicious_kubectl_calls_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kubernetes_nginx_ingress_lfi_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kubernetes_nginx_ingress_rfi_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[kubernetes_scanner_image_pulling_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[large_volume_of_dns_any_queries_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_add_files_in_known_crontab_directories_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_add_user_account_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_at_allow_config_file_creation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_at_application_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_change_file_owner_to_root_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_common_process_for_elevation_control_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_dd_file_overwrite_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_doas_conf_file_creation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_doas_tool_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_edit_cron_table_parameter_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_file_created_in_kernel_driver_directory_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_file_creation_in_init_boot_directory_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_file_creation_in_profile_directory_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_insert_kernel_module_using_insmod_utility_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_install_kernel_module_using_modprobe_utility_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_java_spawning_shell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_nopasswd_entry_in_sudoers_file_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_possible_access_or_modification_of_sshd_config_file_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_possible_access_to_credential_files_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_possible_access_to_sudoers_file_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_possible_append_command_to_at_allow_config_file_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_possible_append_command_to_profile_config_file_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_possible_cronjob_modification_with_editor_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_possible_ssh_key_file_creation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_preload_hijack_library_calls_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_service_file_created_in_systemd_directory_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_service_restarted_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_service_started_or_enabled_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_setuid_using_chmod_utility_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_setuid_using_setcap_utility_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_sudo_or_su_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_sudoers_tmp_file_creation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_system_network_discovery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_visudo_utility_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[linux_pkexec_privilege_escalation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[loading_of_dynwrapx_module_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[local_account_discovery_with_wmic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[local_account_discovery_with_net_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[log4shell_cve_2021_44228_exploitation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[log4shell_jndi_payload_injection_attempt_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[log4shell_jndi_payload_injection_with_outbound_connection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[logon_script_event_trigger_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[ms_scripting_process_loading_ldap_module_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[ms_scripting_process_loading_wmi_module_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[msbuild_suspicious_spawned_by_script_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[mshtml_module_load_in_office_product_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[msi_module_loaded_by_non_system_binary_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[macos___re_opened_applications_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[mailsniper_invoke_functions_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[malicious_inprocserver32_modification_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[malicious_powershell_process___encoded_command_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[malicious_powershell_process___execution_policy_bypass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[malicious_powershell_process___multiple_suspicious_command_line_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[malicious_powershell_process_with_obfuscation_techniques_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[malicious_powershell_executed_as_a_service_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[microsoft_exchange_mailbox_replication_service_writing_active_server_pages_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[mimikatz_passtheticket_commandline_parameters_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[mmc_lolbas_execution_process_spawn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[modification_of_wallpaper_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[modify_acl_permission_to_files_or_folder_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[monitor_dns_for_brand_abuse_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[monitor_email_for_brand_abuse_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[monitor_registry_keys_for_print_monitors_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[monitor_successful_backups_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[monitor_unsuccessful_backups_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[monitor_web_traffic_for_brand_abuse_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[mshta_spawning_rundll32_or_regsvr32_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[msmpeng_application_dll_side_loading_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[multiple_archive_files_http_post_traffic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[multiple_users_attempting_to_authenticate_using_explicit_credentials_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[multiple_users_failing_to_authenticate_from_host_using_kerberos_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[multiple_users_failing_to_authenticate_from_host_using_ntlm_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[multiple_users_failing_to_authenticate_from_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[multiple_users_remotely_failing_to_authenticate_from_host_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[net_profiler_uac_bypass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[nltest_domain_trust_discovery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[net_localgroup_discovery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[network_connection_discovery_with_arp_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[network_connection_discovery_with_net_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[network_connection_discovery_with_netstat_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[network_discovery_using_route_windows_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[new_container_uploaded_to_aws_ecr_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[nishang_powershelltcponeline_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[no_windows_updates_in_a_time_frame_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[non_chrome_process_accessing_chrome_default_dir_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[non_firefox_process_access_firefox_profile_dir_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[ntdsutil_export_ntds_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[o365_add_app_role_assignment_grant_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[o365_added_service_principal_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[o365_bypass_mfa_via_trusted_ip_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[o365_disable_mfa_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[o365_excessive_authentication_failures_alert_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[o365_excessive_sso_logon_errors_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[o365_new_federated_domain_added_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[o365_pst_export_alert_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[o365_suspicious_admin_email_forwarding_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[o365_suspicious_rights_delegation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[o365_suspicious_user_email_forwarding_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[office_application_drop_executable_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[office_application_spawn_regsvr32_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[office_application_spawn_rundll32_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[office_document_creating_schedule_task_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[office_document_executing_macro_code_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[office_document_spawned_child_process_to_download_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[office_product_spawn_cmd_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[office_product_spawning_bitsadmin_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[office_product_spawning_certutil_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[office_product_spawning_mshta_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[office_product_spawning_rundll32_with_no_dll_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[office_product_spawning_wmic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[office_product_writing_cab_or_inf_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[office_spawning_control_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[okta_account_lockout_events_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[okta_failed_sso_attempts_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[okta_user_logins_from_multiple_cities_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[open_redirect_in_splunk_web_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[osquery_pack___coldroot_detection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[outbound_network_connection_from_java_using_default_ports_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[overwriting_accessibility_binaries_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[password_policy_discovery_with_net_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[permission_modification_using_takeown_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[petitpotam_network_share_access_request_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[petitpotam_suspicious_kerberos_tgt_request_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[ping_sleep_batch_command_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[plain_http_post_exfiltrated_data_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[possible_browser_pass_view_parameter_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[possible_lateral_movement_powershell_spawn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[potentially_malicious_code_on_commandline_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[powershell___connect_to_internet_with_hidden_window_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[powershell_4104_hunting_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[powershell_domain_enumeration_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[powershell_get_localgroup_discovery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[powershell_start_bitstransfer_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[powershell_creating_thread_mutex_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[powershell_disable_security_monitoring_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[powershell_enable_smb1protocol_feature_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[powershell_execute_com_object_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[powershell_fileless_process_injection_via_getprocaddress_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[powershell_fileless_script_contains_base64_encoded_content_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[powershell_get_localgroup_discovery_with_script_block_logging_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[powershell_processing_stream_of_data_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[powershell_remote_thread_to_known_windows_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[powershell_remove_windows_defender_directory_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[powershell_using_memory_as_backing_store_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[powershell_windows_defender_exclusion_commands_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[prevent_automatic_repair_mode_using_bcdedit_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_aws_cross_account_activity_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_aws_cross_account_activity___initial_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_aws_cross_account_activity___update_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_aws_provisioning_activity_sources_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_aws_regions_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_cloud_api_calls_per_user_role___initial_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_cloud_api_calls_per_user_role___update_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_cloud_compute_creations_by_user___initial_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_cloud_compute_creations_by_user___update_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_cloud_compute_images___initial_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_cloud_compute_images___update_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_cloud_compute_instance_types___initial_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_cloud_compute_instance_types___update_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_cloud_instance_modifications_by_user___initial_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_cloud_instance_modifications_by_user___update_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_cloud_provisioning_activity_sources___initial_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_cloud_provisioning_activity_sources___update_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_cloud_regions___initial_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_cloud_regions___update_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_ec2_amis_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_ec2_instance_types_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_ec2_launches_by_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_ec2_modifications_by_user_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_running_windows_services___initial_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_running_windows_services___update_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_users_in_cloudtrail___update_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_users_in_cloudtrail___initial_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_zoom_child_processes___initial_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_zoom_child_processes___update_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_api_call_per_user_roles_in_cloudtrail_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_s3_bucket_access_by_remote_ip_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_command_line_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[previously_seen_users_in_cloudtrail_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[print_processor_registry_autostart_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[print_spooler_adding_a_printer_driver_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[print_spooler_failed_to_load_a_plug_in_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[process_creating_lnk_file_in_suspicious_location_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[process_deleting_its_process_file_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[process_execution_via_wmi_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[process_kill_base_on_file_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[process_writing_dynamicwrapperx_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[processes_tapping_keyboard_events_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[processes_created_by_netsh_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[processes_launching_netsh_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[prohibited_network_traffic_allowed_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[prohibited_software_on_endpoint_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[protocol_or_port_mismatch_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[protocols_passing_authentication_in_cleartext_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[randomly_generated_scheduled_task_name_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[randomly_generated_windows_service_name_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[ransomware_notes_bulk_creation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[recon_avproduct_through_pwh_or_wmi_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[recon_using_wmi_class_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[recursive_delete_of_directory_in_batch_cmd_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[reg_exe_manipulating_windows_services_registry_keys_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[reg_exe_used_to_hide_files_directories_via_registry_keys_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[registry_keys_used_for_persistence_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[registry_keys_used_for_privilege_escalation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[registry_keys_for_creating_shim_databases_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[regsvr32_silent_and_install_param_dll_loading_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[regsvr32_with_known_silent_switch_cmdline_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[remcos_rat_file_creation_in_remcos_folder_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[remcos_client_registry_install_entry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[remote_desktop_network_bruteforce_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[remote_desktop_network_traffic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[remote_desktop_process_running_on_system_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[remote_process_instantiation_via_dcom_and_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[remote_process_instantiation_via_dcom_and_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[remote_process_instantiation_via_wmi_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[remote_process_instantiation_via_wmi_and_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[remote_process_instantiation_via_wmi_and_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[remote_process_instantiation_via_winrm_and_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[remote_process_instantiation_via_winrm_and_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[remote_process_instantiation_via_winrm_and_winrs_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[remote_registry_key_modifications_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[remote_system_discovery_with_adsisearcher_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[remote_system_discovery_with_dsquery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[remote_system_discovery_with_net_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[remote_system_discovery_with_wmic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[remote_wmi_command_attempt_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[resize_shadowstorage_volume_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[revil_common_exec_parameter_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[revil_registry_entry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[rubeus_command_line_parameters_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[rubeus_kerberos_ticket_exports_through_winlogon_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[rundll_loading_dll_by_ordinal_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[runas_execution_in_commandline_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[rundll32_control_rundll_hunt_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[rundll32_control_rundll_world_writable_directory_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[rundll32_create_remote_thread_to_a_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[rundll32_createremotethread_in_browser_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[rundll32_dnsquery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[rundll32_lockworkstation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[rundll32_process_creating_exe_dll_files_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[rundll32_shimcache_flush_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[rundll32_with_no_command_line_arguments_with_network_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[ryuk_test_files_detected_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[ryuk_wake_on_lan_command_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[sam_database_file_access_attempt_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[slui_runas_elevated_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[slui_spawning_a_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[smb_traffic_spike_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[smb_traffic_spike___mltk_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[sql_injection_with_long_urls_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[samsam_test_file_write_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[sc_exe_manipulating_windows_services_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[schcache_change_by_app_connect_and_create_adsi_object_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[schedule_task_with_http_command_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[schedule_task_with_rundll32_command_trigger_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[scheduled_task_creation_on_remote_endpoint_using_at_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[scheduled_task_deleted_or_created_via_cmd_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[scheduled_task_initiation_on_remote_endpoint_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[scheduled_tasks_used_in_badrabbit_ransomware_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[schtasks_run_task_on_demand_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[schtasks_scheduling_job_on_remote_system_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[schtasks_used_for_forcing_a_reboot_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[screensaver_event_trigger_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[script_execution_via_wmi_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[sdclt_uac_bypass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[sdelete_application_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[searchprotocolhost_with_no_command_line_with_network_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[secretdumps_offline_ntds_dumping_tool_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[serviceprincipalnames_discovery_with_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[serviceprincipalnames_discovery_with_setspn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[services_escalate_exe_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[services_lolbas_execution_process_spawn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[shim_database_file_creation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[shim_database_installation_with_suspicious_parameters_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[short_lived_scheduled_task_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[short_lived_windows_accounts_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[silentcleanup_uac_bypass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[single_letter_process_on_endpoint_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[spectre_and_meltdown_vulnerable_systems_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[spike_in_file_writes_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[splunk_enterprise_information_disclosure_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[spoolsv_spawning_rundll32_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[spoolsv_suspicious_loaded_modules_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[spoolsv_suspicious_process_access_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[spoolsv_writing_a_dll_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[spoolsv_writing_a_dll___sysmon_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[sqlite_module_in_temp_folder_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[start_up_during_safe_mode_boot_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[sunburst_correlation_dll_and_network_event_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[supernova_webshell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_changes_to_file_associations_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_computer_account_name_change_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_copy_on_system32_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_curl_network_connection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_dllhost_no_command_line_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_driver_loaded_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_email___uba_anomaly_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_email_attachment_extensions_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_event_log_service_behavior_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_file_write_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_gpupdate_no_command_line_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_icedid_rundll32_cmdline_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_image_creation_in_appdata_folder_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_java_classes_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_kerberos_service_ticket_request_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_linux_discovery_commands_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_msbuild_rename_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_msbuild_spawn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_plistbuddy_usage_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_plistbuddy_usage_via_osquery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_process_dns_query_known_abuse_web_services_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_process_file_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_process_with_discord_dns_query_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_reg_exe_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_regsvr32_register_suspicious_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_rundll32_plugininit_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_rundll32_rename_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_rundll32_startw_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_rundll32_dllregisterserver_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_rundll32_no_command_line_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_sqlite3_lsquarantine_behavior_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_scheduled_task_from_public_directory_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_searchprotocolhost_no_command_line_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_ticket_granting_ticket_request_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_wav_file_in_appdata_folder_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_microsoft_workflow_compiler_rename_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_microsoft_workflow_compiler_usage_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_msbuild_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_mshta_child_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_mshta_spawn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_wevtutil_usage_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_writes_to_system_volume_information_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[suspicious_writes_to_windows_recycle_bin_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[svchost_lolbas_execution_process_spawn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[system_info_gathering_using_dxdiag_application_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[system_information_discovery_detection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[system_processes_run_from_unexpected_locations_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[system_user_discovery_with_query_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[system_user_discovery_with_whoami_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[systems_ready_for_spectre_meltdown_windows_patch_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[tor_traffic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[time_provider_persistence_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[trickbot_named_pipe_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[uac_bypass_mmc_load_unsigned_dll_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[uac_bypass_with_colorui_com_object_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[usn_journal_deletion_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[uncommon_processes_on_endpoint_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[unified_messaging_service_spawning_a_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[uninstall_app_using_msiexec_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[unload_sysmon_filter_driver_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[unloading_amsi_via_reflection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[unsigned_image_loaded_by_lsass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[unsuccessful_netbackup_backups_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[unusual_number_of_computer_service_tickets_requested_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[unusual_number_of_kerberos_service_tickets_requested_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[unusual_number_of_remote_endpoint_authentication_events_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[unusually_long_command_line_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[unusually_long_command_line___mltk_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[unusually_long_content_type_length_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[update_previously_seen_users_in_cloudtrail_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[user_discovery_with_env_vars_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[user_discovery_with_env_vars_powershell_script_block_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[vbscript_execution_using_wscript_app_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[verclsid_clsid_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[w3wp_spawning_shell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[wbadmin_delete_system_backups_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[wmi_permanent_event_subscription_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[wmi_permanent_event_subscription___sysmon_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[wmi_recon_running_process_or_services_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[wmi_temporary_event_subscription_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[wmic_xsl_execution_via_url_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[wsreset_uac_bypass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[wbemprox_com_object_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[web_fraud___account_harvesting_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[web_fraud___anomalous_user_clickspeed_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[web_fraud___password_sharing_across_accounts_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[web_servers_executing_suspicious_processes_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[wermgr_process_connecting_to_ip_check_web_services_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[wermgr_process_create_executable_file_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[wermgr_process_spawned_cmd_or_powershell_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[wget_download_and_bash_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[winevent_scheduled_task_created_within_public_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[winevent_scheduled_task_created_to_spawn_shell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[winevent_windows_task_scheduler_event_action_started_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[winrm_spawning_a_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_adfind_exe_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_curl_download_to_suspicious_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_curl_upload_to_remote_destination_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_dism_remove_defender_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_defender_exclusion_registry_entry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_disable_memory_crash_dump_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_disableantispyware_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_diskcryptor_usage_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_diskshadow_proxy_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_dotnet_binary_in_non_standard_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_event_for_service_disabled_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_event_log_cleared_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_excessive_disabled_services_event_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_file_without_extension_in_critical_folder_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_high_file_deletion_frequency_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_hunting_system_account_targeting_lsass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_indirect_command_execution_via_forfiles_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_indirect_command_execution_via_pcalua_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_installutil_credential_theft_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_installutil_remote_network_connection_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_installutil_url_in_command_line_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_installutil_uninstall_option_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_installutil_uninstall_option_with_network_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_installutil_in_non_standard_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_java_spawning_shells_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_modify_show_compress_color_and_info_tip_registry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_nirsoft_advancedrun_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_nirsoft_utilities_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_non_system_account_targeting_lsass_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_possible_credential_dumping_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_process_with_namedpipe_commandline_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_raccine_scheduled_task_deletion_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_rasautou_dll_execution_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_raw_access_to_disk_volume_partition_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_raw_access_to_master_boot_record_drive_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_remote_assistance_spawning_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_schtasks_create_run_as_system_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_security_account_manager_stopped_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_service_created_with_suspicious_service_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_service_created_within_public_path_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_service_creation_using_registry_entry_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_service_creation_on_remote_endpoint_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_service_initiation_on_remote_endpoint_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_updates_install_failures_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_updates_install_successes_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_wmi_process_call_create_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_connhost_exe_started_forcefully_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[windows_hosts_file_modification_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[winhlp32_spawning_a_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[winword_spawning_cmd_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[winword_spawning_powershell_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[winword_spawning_windows_script_host_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[wmic_group_discovery_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[wmic_noninteractive_app_uninstallation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[wmiprsve_lolbas_execution_process_spawn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[wscript_or_cscript_suspicious_child_process_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[wsmprovhost_lolbas_execution_process_spawn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[xmrig_driver_loaded_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[xsl_script_execution_with_wmic_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_detect_attach_to_role_policy_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_detect_permanent_key_creation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_detect_role_creation_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_detect_sts_assume_role_abuse_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[aws_detect_sts_get_session_token_abuse_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[gcp_detect_oauth_token_abuse_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-

From 082d15ac3d5e0c6fe767de6004ae12277a608571 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 5 Apr 2022 14:14:42 -0700
Subject: [PATCH 20/20] Updating paths to dataset for testing

---
 .../windows_indirect_command_execution_via_forfiles.test.yml    | 2 +-
 .../windows_indirect_command_execution_via_pcalua.test.yml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml b/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml
index f103195c97..0287f2d7a4 100644
--- a/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml
+++ b/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml
@@ -7,6 +7,6 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/InDirectToVideo/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml b/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml
index dcd72d6166..bb3a0c3114 100644
--- a/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml
+++ b/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml
@@ -7,6 +7,6 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/InDirectToVideo/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
\ No newline at end of file