From ceabbaad1f3040bb48036286005cf754f4e2e87c Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 15 Feb 2022 10:03:48 +0100 Subject: [PATCH] updated github action --- .github/workflows/build-and-validate.yml | 1 + .../domain/entities/unit_test_test.py | 2 +- dist/api/detections.json | 5400 ++++++------- dist/api/stories.json | 7172 ++++++++--------- dist/escu/default/analyticstories.conf | 2 +- dist/escu/default/collections.conf | 2 +- ...l_backup_logs_for_host___response_task.xml | 2 +- ...tes_activity_by_src_ip___response_task.xml | 2 +- ...ity_hub_alerts_by_dest___response_task.xml | 2 +- ...ivities_by_accesskeyid___response_task.xml | 2 +- ...user_activities_by_arn___response_task.xml | 2 +- ...rk_acl_details_from_id___response_task.xml | 2 +- ...details_via_resourceid___response_task.xml | 2 +- ...details_via_bucketname___response_task.xml | 2 +- ...tes_activity_by_src_ip___response_task.xml | 2 +- ...aws_activity_from_city___response_task.xml | 2 +- ..._activity_from_country___response_task.xml | 2 +- ...tivity_from_ip_address___response_task.xml | 2 +- ...s_activity_from_region___response_task.xml | 2 +- ...ckup_logs_for_endpoint___response_task.xml | 2 +- ...cate_logs_for_a_domain___response_task.xml | 2 +- ...ver_history_for_a_host___response_task.xml | 2 +- ..._get_dns_traffic_ratio___response_task.xml | 2 +- ..._details_by_instanceid___response_task.xml | 2 +- ...get_ec2_launch_details___response_task.xml | 2 +- ...h_panel_get_email_info___response_task.xml | 2 +- ...s_from_specific_sender___response_task.xml | 2 +- ...rence_of_a_mac_address___response_task.xml | 2 +- ...story_of_email_sources___response_task.xml | 2 +- ...fications_for_endpoint___response_task.xml | 2 +- ...modifications_for_user___response_task.xml | 2 +- ...el_get_notable_history___response_task.xml | 2 +- ...et_parent_process_info___response_task.xml | 2 +- ..._process_file_activity___response_task.xml | 2 +- ...panel_get_process_info___response_task.xml | 2 +- ...tion_for_port_activity___response_task.xml | 2 +- ...le_for_the_dns_traffic___response_task.xml | 2 +- ..._wmi_activity_for_host___response_task.xml | 2 +- ...rmation_via_session_id___response_task.xml | 2 +- ...vities_via_region_name___response_task.xml | 2 +- ...tivities_by_user_field___response_task.xml | 2 +- ..._multiple_destinations___response_task.xml | 2 +- ...rk_traffic_from_src_ip___response_task.xml | 2 +- ...e_okta_activity_by_app___response_task.xml | 2 +- ...pass_the_hash_attempts___response_task.xml | 2 +- ...ss_the_ticket_attempts___response_task.xml | 2 +- ...e_previous_unseen_user___response_task.xml | 2 +- ...esktop_authentications___response_task.xml | 2 +- ...strings_in_http_header___response_task.xml | 2 +- ...ser_activities_in_okta___response_task.xml | 2 +- ...ate_web_posts_from_src___response_task.xml | 2 +- dist/escu/default/es_investigations.conf | 2 +- dist/escu/default/macros.conf | 2 +- dist/escu/default/savedsearches.conf | 2 +- dist/escu/default/transforms.conf | 2 +- dist/escu/default/workflow_actions.conf | 2 +- 56 files changed, 6340 insertions(+), 6339 deletions(-) diff --git a/.github/workflows/build-and-validate.yml b/.github/workflows/build-and-validate.yml index ad45750115..4d73ca5b90 100644 --- a/.github/workflows/build-and-validate.yml +++ b/.github/workflows/build-and-validate.yml @@ -128,6 +128,7 @@ jobs: - name: Install System Packages run: | + sudo apt upgrade -qq sudo apt update -qq sudo apt install jq -qq diff --git a/bin/contentctl_project/contentctl_core/domain/entities/unit_test_test.py b/bin/contentctl_project/contentctl_core/domain/entities/unit_test_test.py index e5a0cb05cf..2e21e7a4c7 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/unit_test_test.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/unit_test_test.py @@ -1,6 +1,6 @@ -from pydantic import BaseModel +from pydantic import BaseModel, validator, ValidationError from contentctl_core.domain.entities.unit_test_attack_data import UnitTestAttackData from contentctl_core.domain.entities.unit_test_baseline import UnitTestBaseline diff --git a/dist/api/detections.json b/dist/api/detections.json index 87cf0aa527..5f2039a431 100644 --- a/dist/api/detections.json +++ b/dist/api/detections.json @@ -1467,12 +1467,6 @@ ] }, "macros": [ - { - "name": "aws_ecr_users", - "definition": "userName IN (user)", - "description": "specify the user allowed to push Images to AWS ECR.", - "arguments": null - }, { "name": "cloudtrail", "definition": "sourcetype=aws:cloudtrail", @@ -1487,6 +1481,12 @@ "field" ] }, + { + "name": "aws_ecr_users", + "definition": "userName IN (user)", + "description": "specify the user allowed to push Images to AWS ECR.", + "arguments": null + }, { "name": "aws_ecr_container_upload_unknown_user_filter", "definition": "search *", @@ -3032,12 +3032,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "circleci", - "definition": "sourcetype=circleci", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -3046,6 +3040,12 @@ "field" ] }, + { + "name": "circleci", + "definition": "sourcetype=circleci", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", + "arguments": null + }, { "name": "circle_ci_disable_security_job_filter", "definition": "search *", @@ -3126,12 +3126,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "circleci", - "definition": "sourcetype=circleci", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -3140,6 +3134,12 @@ "field" ] }, + { + "name": "circleci", + "definition": "sourcetype=circleci", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", + "arguments": null + }, { "name": "circle_ci_disable_security_step_filter", "definition": "search *", @@ -3402,12 +3402,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -3416,6 +3410,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "cloud_compute_instance_created_by_previously_unseen_user_filter", "definition": "search *", @@ -3843,12 +3843,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -3857,6 +3851,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "cloud_instance_modified_by_previously_unseen_user_filter", "definition": "search *", @@ -3994,12 +3994,6 @@ ] }, "macros": [ - { - "name": "previously_unseen_cloud_provisioning_activity_window", - "definition": "\"-70m@m\"", - "description": "Use this macro to determine how far back you should be checking for new provisioning activities", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -4008,6 +4002,12 @@ "field" ] }, + { + "name": "previously_unseen_cloud_provisioning_activity_window", + "definition": "\"-70m@m\"", + "description": "Use this macro to determine how far back you should be checking for new provisioning activities", + "arguments": null + }, { "name": "cloud_provisioning_activity_from_previously_unseen_city_filter", "definition": "search *", @@ -4290,12 +4290,6 @@ ] }, "macros": [ - { - "name": "previously_unseen_cloud_provisioning_activity_window", - "definition": "\"-70m@m\"", - "description": "Use this macro to determine how far back you should be checking for new provisioning activities", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -4304,6 +4298,12 @@ "field" ] }, + { + "name": "previously_unseen_cloud_provisioning_activity_window", + "definition": "\"-70m@m\"", + "description": "Use this macro to determine how far back you should be checking for new provisioning activities", + "arguments": null + }, { "name": "cloud_provisioning_activity_from_previously_unseen_ip_address_filter", "definition": "search *", @@ -4441,12 +4441,6 @@ ] }, "macros": [ - { - "name": "previously_unseen_cloud_provisioning_activity_window", - "definition": "\"-70m@m\"", - "description": "Use this macro to determine how far back you should be checking for new provisioning activities", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -4455,6 +4449,12 @@ "field" ] }, + { + "name": "previously_unseen_cloud_provisioning_activity_window", + "definition": "\"-70m@m\"", + "description": "Use this macro to determine how far back you should be checking for new provisioning activities", + "arguments": null + }, { "name": "cloud_provisioning_activity_from_previously_unseen_region_filter", "definition": "search *", @@ -5513,12 +5513,6 @@ ] }, "macros": [ - { - "name": "github", - "definition": "sourcetype=aws:firehose:json", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -5527,6 +5521,12 @@ "field" ] }, + { + "name": "github", + "definition": "sourcetype=aws:firehose:json", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", + "arguments": null + }, { "name": "github_commit_changes_in_master_filter", "definition": "search *", @@ -5609,12 +5609,6 @@ ] }, "macros": [ - { - "name": "github", - "definition": "sourcetype=aws:firehose:json", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -5623,6 +5617,12 @@ "field" ] }, + { + "name": "github", + "definition": "sourcetype=aws:firehose:json", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", + "arguments": null + }, { "name": "github_commit_in_develop_filter", "definition": "search *", @@ -5719,12 +5719,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "github", - "definition": "sourcetype=aws:firehose:json", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -5733,6 +5727,12 @@ "field" ] }, + { + "name": "github", + "definition": "sourcetype=aws:firehose:json", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", + "arguments": null + }, { "name": "github_dependabot_alert_filter", "definition": "search *", @@ -5829,9 +5829,9 @@ }, "macros": [ { - "name": "github", - "definition": "sourcetype=aws:firehose:json", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", + "name": "github_known_users", + "definition": "user IN (user_names_here)", + "description": "specify the user allowed to create PRs in Github projects.", "arguments": null }, { @@ -5843,9 +5843,9 @@ ] }, { - "name": "github_known_users", - "definition": "user IN (user_names_here)", - "description": "specify the user allowed to create PRs in Github projects.", + "name": "github", + "definition": "sourcetype=aws:firehose:json", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", "arguments": null }, { @@ -9462,15 +9462,27 @@ }, "macros": [ { - "name": "evilginx_phishlets_aws", - "definition": "(query=www* AND query=aws* AND query=console.aws* AND query=signin.aws* AND api-northeast-1.console.aws* AND query=fls-na* AND query=images-na*)", - "description": "This limits the query fields to domains that are associated with evilginx masquerading as an AWS console", + "name": "evilginx_phishlets_facebook", + "definition": "(query=www* AND query = m* AND query=static*)", + "description": "This limits the query fields to domains that are associated with evilginx masquerading as FaceBook", "arguments": null }, { - "name": "evilginx_phishlets_0365", - "definition": "(query=login* AND query=www*)", - "description": "This limits the query fields to domains that are associated with evilginx masquerading as Office 365", + "name": "evilginx_phishlets_amazon", + "definition": "(query=fls-na* AND query = www* AND query=images*)", + "description": "This limits the query fields to domains that are associated with evilginx masquerading as Amazon", + "arguments": null + }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, + { + "name": "evilginx_phishlets_google", + "definition": "(query=accounts* AND query=ssl* AND query=www*)", + "description": "This limits the query fields to domains that are associated with evilginx masquerading as Google", "arguments": null }, { @@ -9486,27 +9498,15 @@ "arguments": null }, { - "name": "evilginx_phishlets_facebook", - "definition": "(query=www* AND query = m* AND query=static*)", - "description": "This limits the query fields to domains that are associated with evilginx masquerading as FaceBook", + "name": "evilginx_phishlets_0365", + "definition": "(query=login* AND query=www*)", + "description": "This limits the query fields to domains that are associated with evilginx masquerading as Office 365", "arguments": null }, { - "name": "evilginx_phishlets_google", - "definition": "(query=accounts* AND query=ssl* AND query=www*)", - "description": "This limits the query fields to domains that are associated with evilginx masquerading as Google", - "arguments": null - }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, - { - "name": "evilginx_phishlets_amazon", - "definition": "(query=fls-na* AND query = www* AND query=images*)", - "description": "This limits the query fields to domains that are associated with evilginx masquerading as Amazon", + "name": "evilginx_phishlets_aws", + "definition": "(query=www* AND query=aws* AND query=console.aws* AND query=signin.aws* AND api-northeast-1.console.aws* AND query=fls-na* AND query=images-na*)", + "description": "This limits the query fields to domains that are associated with evilginx masquerading as an AWS console", "arguments": null }, { @@ -9607,12 +9607,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -9621,6 +9615,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_long_dns_txt_record_response_filter", "definition": "search *", @@ -10123,18 +10123,18 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "network_acl_events", - "definition": "(eventName = CreateNetworkAcl OR eventName = CreateNetworkAclEntry OR eventName = DeleteNetworkAcl OR eventName = DeleteNetworkAclEntry OR eventName = ReplaceNetworkAclEntry OR eventName = ReplaceNetworkAclAssociation)", - "description": "This is a list of AWS event names that are associated with Network ACLs", - "arguments": null - }, { "name": "cloudtrail", "definition": "sourcetype=aws:cloudtrail", "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", "arguments": null }, + { + "name": "network_acl_events", + "definition": "(eventName = CreateNetworkAcl OR eventName = CreateNetworkAclEntry OR eventName = DeleteNetworkAcl OR eventName = DeleteNetworkAclEntry OR eventName = ReplaceNetworkAclEntry OR eventName = ReplaceNetworkAclAssociation)", + "description": "This is a list of AWS event names that are associated with Network ACLs", + "arguments": null + }, { "name": "detect_spike_in_network_acl_activity_filter", "definition": "search *", @@ -10310,12 +10310,6 @@ "mitre_attack_groups": null }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -10324,6 +10318,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_usb_device_insertion_filter", "definition": "search *", @@ -10459,12 +10459,6 @@ "description": "This is a description", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -10473,6 +10467,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_web_traffic_to_dynamic_domain_providers_filter", "definition": "search *", @@ -11023,18 +11023,18 @@ ] }, "macros": [ - { - "name": "ec2_modification_api_calls", - "definition": "(eventName=AssociateAddress OR eventName=AssociateIamInstanceProfile OR eventName=AttachClassicLinkVpc OR eventName=AttachNetworkInterface OR eventName=AttachVolume OR eventName=BundleInstance OR eventName=DetachClassicLinkVpc OR eventName=DetachVolume OR eventName=ModifyInstanceAttribute OR eventName=ModifyInstancePlacement OR eventName=MonitorInstances OR eventName=RebootInstances OR eventName=ResetInstanceAttribute OR eventName=StartInstances OR eventName=StopInstances OR eventName=TerminateInstances OR eventName=UnmonitorInstances)", - "description": "This is a list of AWS event names that have to do with modifying Amazon EC2 instances", - "arguments": null - }, { "name": "cloudtrail", "definition": "sourcetype=aws:cloudtrail", "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", "arguments": null }, + { + "name": "ec2_modification_api_calls", + "definition": "(eventName=AssociateAddress OR eventName=AssociateIamInstanceProfile OR eventName=AttachClassicLinkVpc OR eventName=AttachNetworkInterface OR eventName=AttachVolume OR eventName=BundleInstance OR eventName=DetachClassicLinkVpc OR eventName=DetachVolume OR eventName=ModifyInstanceAttribute OR eventName=ModifyInstancePlacement OR eventName=MonitorInstances OR eventName=RebootInstances OR eventName=ResetInstanceAttribute OR eventName=StartInstances OR eventName=StopInstances OR eventName=TerminateInstances OR eventName=UnmonitorInstances)", + "description": "This is a list of AWS event names that have to do with modifying Amazon EC2 instances", + "arguments": null + }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -11501,12 +11501,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -11515,6 +11509,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "execution_of_file_with_spaces_before_extension_filter", "definition": "search *", @@ -11587,12 +11587,6 @@ "mitre_attack_groups": null }, "macros": [ - { - "name": "netbackup", - "definition": "sourcetype=\"netbackup_logs\"", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -11601,6 +11595,12 @@ "field" ] }, + { + "name": "netbackup", + "definition": "sourcetype=\"netbackup_logs\"", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", + "arguments": null + }, { "name": "extended_period_without_successful_netbackup_backups_filter", "definition": "search *", @@ -11770,12 +11770,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -11784,6 +11778,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "first_time_seen_command_line_argument_filter", "definition": "search *", @@ -13914,12 +13914,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -13928,6 +13922,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "malicious_powershell_process___multiple_suspicious_command_line_arguments_filter", "definition": "search *", @@ -13997,12 +13997,6 @@ "mitre_attack_groups": null }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "brand_abuse_dns", "definition": "lookup update=true brandMonitoring_lookup domain as query OUTPUT domain_abuse | search domain_abuse=true", @@ -14017,6 +14011,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "monitor_dns_for_brand_abuse_filter", "definition": "search *", @@ -14257,12 +14257,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -14271,6 +14265,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "processes_created_by_netsh_filter", "definition": "search *", @@ -14354,12 +14354,6 @@ "description": "This macro limits the output to process_names that have been marked as prohibited", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -14368,6 +14362,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "prohibited_software_on_endpoint_filter", "definition": "search *", @@ -14456,12 +14456,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -14470,6 +14464,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "reg_exe_used_to_hide_files_directories_via_registry_keys_filter", "definition": "search *", @@ -14543,12 +14543,6 @@ "mitre_attack_groups": null }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -14557,6 +14551,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "remote_registry_key_modifications_filter", "definition": "search *", @@ -14682,12 +14682,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -14696,6 +14690,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "rundll_loading_dll_by_ordinal_filter", "definition": "search *", @@ -14815,12 +14815,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -14829,6 +14823,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "scheduled_tasks_used_in_badrabbit_ransomware_filter", "definition": "search *", @@ -14904,12 +14904,6 @@ "mitre_attack_groups": null }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -14918,6 +14912,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "spectre_and_meltdown_vulnerable_systems_filter", "definition": "search *", @@ -15086,12 +15086,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -15100,6 +15094,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "suspicious_changes_to_file_associations_filter", "definition": "search *", @@ -15181,12 +15181,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -15195,6 +15189,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "suspicious_email___uba_anomaly_filter", "definition": "search *", @@ -15266,12 +15266,6 @@ "mitre_attack_groups": null }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "suspicious_writes", "definition": "lookup suspicious_writes_lookup file as file_name OUTPUT note as \"Reference\" | search \"Reference\" != False", @@ -15286,6 +15280,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "suspicious_file_write_filter", "definition": "search *", @@ -15431,12 +15431,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -15445,6 +15439,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "suspicious_rundll32_rename_filter", "definition": "search *", @@ -15702,12 +15702,6 @@ "description": "This macro limits the output to processes that have been marked as uncommon", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -15716,6 +15710,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "uncommon_processes_on_endpoint_filter", "definition": "search *", @@ -15910,12 +15910,6 @@ "mitre_attack_groups": null }, "macros": [ - { - "name": "netbackup", - "definition": "sourcetype=\"netbackup_logs\"", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -15924,6 +15918,12 @@ "field" ] }, + { + "name": "netbackup", + "definition": "sourcetype=\"netbackup_logs\"", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", + "arguments": null + }, { "name": "unsuccessful_netbackup_backups_filter", "definition": "search *", @@ -16355,12 +16355,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -16369,6 +16363,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "windows_connhost_exe_started_forcefully_filter", "definition": "search *", @@ -16445,12 +16445,6 @@ "mitre_attack_groups": null }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -16459,6 +16453,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "windows_hosts_file_modification_filter", "definition": "search *", @@ -16586,12 +16586,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -16600,6 +16594,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "7zip_commandline_to_smb_share_path_filter", "definition": "search *", @@ -16880,12 +16880,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -16894,6 +16888,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "account_discovery_with_net_app_filter", "definition": "search *", @@ -17208,12 +17208,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -17222,6 +17216,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "add_or_set_windows_defender_exclusion_filter", "definition": "search *", @@ -17437,12 +17437,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "process_netsh", "definition": "(Processes.process_name=netsh.exe OR Processes.original_file_name=netsh.exe)", @@ -17457,6 +17451,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "allow_file_and_printing_sharing_in_firewall_filter", "definition": "search *", @@ -17804,12 +17804,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "process_netsh", "definition": "(Processes.process_name=netsh.exe OR Processes.original_file_name=netsh.exe)", @@ -17824,6 +17818,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "allow_network_discovery_in_firewall_filter", "definition": "search *", @@ -18067,12 +18067,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -18081,6 +18075,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "anomalous_usage_of_7zip_filter", "definition": "search *", @@ -18262,10 +18262,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -18274,12 +18276,10 @@ "arguments": null }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null }, { "name": "any_powershell_downloadfile_filter", @@ -18462,10 +18462,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -18474,12 +18476,10 @@ "arguments": null }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null }, { "name": "any_powershell_downloadstring_filter", @@ -18650,12 +18650,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -18664,6 +18658,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "attacker_tools_on_endpoint_filter", "definition": "search *", @@ -18783,6 +18783,14 @@ "mitre_attack_groups": [] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_certutil", "definition": "(Processes.process_name=certutil.exe OR Processes.original_file_name=CertUtil.exe)", @@ -18795,14 +18803,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "attempt_to_add_certificate_to_untrusted_store_filter", "definition": "search *", @@ -18950,12 +18950,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -18964,6 +18958,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "attempt_to_stop_security_service_filter", "definition": "search *", @@ -19108,6 +19108,14 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -19120,14 +19128,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "attempted_credential_dump_from_registry_via_reg_exe_filter", "definition": "search *", @@ -19491,12 +19491,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -19505,6 +19499,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "bcdedit_command_back_to_normal_mode_boot_filter", "definition": "search *", @@ -19614,12 +19614,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -19628,6 +19622,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "bcdedit_failure_recovery_modification_filter", "definition": "search *", @@ -19754,12 +19754,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -19768,6 +19762,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "bits_job_persistence_filter", "definition": "search *", @@ -19957,12 +19957,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -19971,6 +19965,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "bitsadmin_download_file_filter", "definition": "search *", @@ -20148,6 +20148,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_certutil", "definition": "(Processes.process_name=certutil.exe OR Processes.original_file_name=CertUtil.exe)", @@ -20160,14 +20168,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "certutil_download_with_urlcache_and_split_arguments_filter", "definition": "search *", @@ -20346,6 +20346,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_certutil", "definition": "(Processes.process_name=certutil.exe OR Processes.original_file_name=CertUtil.exe)", @@ -20358,14 +20366,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "certutil_download_with_verifyctl_and_split_arguments_filter", "definition": "search *", @@ -20470,12 +20470,6 @@ "mitre_attack_groups": null }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -20484,6 +20478,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "certutil_exe_certificate_extraction_filter", "definition": "search *", @@ -20622,6 +20622,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_certutil", "definition": "(Processes.process_name=certutil.exe OR Processes.original_file_name=CertUtil.exe)", @@ -20634,14 +20642,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "certutil_with_decode_argument_filter", "definition": "search *", @@ -20739,12 +20739,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -20753,6 +20747,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "change_default_file_association_filter", "definition": "search *", @@ -20844,12 +20844,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -20858,6 +20852,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "change_to_safe_mode_with_network_config_filter", "definition": "search *", @@ -20968,12 +20968,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -20982,6 +20976,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "chcp_command_execution_filter", "definition": "search *", @@ -21100,12 +21100,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -21114,6 +21108,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "check_elevated_cmd_using_whoami_filter", "definition": "search *", @@ -21265,12 +21265,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -21279,6 +21273,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "clear_unallocated_sector_using_cipher_app_filter", "definition": "search *", @@ -21391,12 +21391,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -21405,6 +21399,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "clop_common_exec_parameter_filter", "definition": "search *", @@ -21513,12 +21513,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "wineventlog_system", - "definition": "eventtype=wineventlog_system", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -21527,6 +21521,12 @@ "field" ] }, + { + "name": "wineventlog_system", + "definition": "eventtype=wineventlog_system", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", + "arguments": null + }, { "name": "clop_ransomware_known_service_name_filter", "definition": "search *", @@ -21688,6 +21688,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -21700,14 +21708,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "cmd_carry_out_string_command_parameter_filter", "definition": "search *", @@ -21893,6 +21893,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -21905,14 +21913,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "cmd_echo_pipe___escalation_filter", "definition": "search *", @@ -22054,12 +22054,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -22068,6 +22062,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "cmdline_tool_not_executed_in_cmd_shell_filter", "definition": "search *", @@ -22437,12 +22437,6 @@ "description": "This macro limits the output to files that have extensions associated with ransomware", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -22451,6 +22445,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "common_ransomware_extensions_filter", "definition": "search *", @@ -22564,12 +22564,6 @@ "description": "This macro limits the output to files that have been identified as a ransomware note", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -22578,6 +22572,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "common_ransomware_notes_filter", "definition": "search *", @@ -22689,12 +22689,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -22703,6 +22697,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "conti_common_exec_parameter_filter", "definition": "search *", @@ -22819,12 +22819,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -22833,6 +22827,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "control_loading_from_world_writable_directory_filter", "definition": "search *", @@ -22961,12 +22961,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -22975,6 +22969,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "create_local_admin_accounts_using_net_exe_filter", "definition": "search *", @@ -23102,12 +23102,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -23116,6 +23110,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "create_or_delete_windows_shares_using_net_exe_filter", "definition": "search *", @@ -23685,12 +23685,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -23699,6 +23693,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "creation_of_shadow_copy_filter", "definition": "search *", @@ -23843,10 +23843,12 @@ "arguments": null }, { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -23855,12 +23857,10 @@ "arguments": null }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null }, { "name": "creation_of_shadow_copy_with_wmic_and_powershell_filter", @@ -23999,6 +23999,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -24011,14 +24019,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "credential_dumping_via_copy_command_from_shadow_copy_filter", "definition": "search *", @@ -24156,6 +24156,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -24168,14 +24176,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "credential_dumping_via_symlink_to_shadow_copy_filter", "definition": "search *", @@ -24329,6 +24329,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_csc", "definition": "(Processes.process_name=csc.exe OR Processes.original_file_name=csc.exe)", @@ -24341,14 +24349,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "csc_net_on_the_fly_compilation_filter", "definition": "search *", @@ -24518,12 +24518,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -24532,6 +24526,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "curl_download_and_bash_execution_filter", "definition": "search *", @@ -24756,12 +24756,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -24770,6 +24764,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "deleting_of_net_users_filter", "definition": "search *", @@ -24889,12 +24889,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -24903,6 +24897,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "deleting_shadow_copies_filter", "definition": "search *", @@ -25184,12 +25184,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -25198,6 +25192,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_azurehound_command_line_arguments_filter", "definition": "search *", @@ -25334,12 +25334,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -25348,6 +25342,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_azurehound_file_modifications_filter", "definition": "search *", @@ -25938,12 +25938,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -25952,6 +25946,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_excessive_account_lockouts_from_endpoint_filter", "definition": "search *", @@ -26086,12 +26086,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -26100,6 +26094,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_excessive_user_account_lockouts_filter", "definition": "search *", @@ -26375,12 +26375,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -26389,6 +26383,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_html_help_renamed_filter", "definition": "search *", @@ -26517,12 +26517,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -26531,6 +26525,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_html_help_spawn_child_process_filter", "definition": "search *", @@ -26666,12 +26666,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -26680,6 +26674,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_html_help_url_in_command_line_filter", "definition": "search *", @@ -26808,12 +26808,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -26822,6 +26816,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_html_help_using_infotech_storage_handlers_filter", "definition": "search *", @@ -27233,6 +27233,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_mshta", "definition": "(Processes.process_name=mshta.exe OR Processes.original_file_name=MSHTA.EXE)", @@ -27245,14 +27253,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "detect_mshta_inline_hta_execution_filter", "definition": "search *", @@ -27381,6 +27381,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_mshta", "definition": "(Processes.process_name=mshta.exe OR Processes.original_file_name=MSHTA.EXE)", @@ -27393,14 +27401,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "detect_mshta_renamed_filter", "definition": "search *", @@ -27530,6 +27530,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_mshta", "definition": "(Processes.process_name=mshta.exe OR Processes.original_file_name=MSHTA.EXE)", @@ -27542,14 +27550,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "detect_mshta_url_in_command_line_filter", "definition": "search *", @@ -27792,12 +27792,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -27806,6 +27800,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_path_interception_by_creation_of_program_exe_filter", "definition": "search *", @@ -27959,12 +27959,6 @@ "description": "This macro is a list of process that can be used to discover the network configuration", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -27973,6 +27967,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_processes_used_for_system_network_configuration_discovery_filter", "definition": "search *", @@ -28159,6 +28159,14 @@ "description": "This macro outputs a list of process that should not be the parent process of cmd.exe", "arguments": null }, + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -28171,14 +28179,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "detect_prohibited_applications_spawning_cmd_exe_filter", "definition": "search *", @@ -28324,12 +28324,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -28338,6 +28332,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_psexec_with_accepteula_flag_filter", "definition": "search *", @@ -28456,6 +28456,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_rclone", "definition": "(Processes.original_file_name=rclone.exe OR Processes.process_name=rclone.exe)", @@ -28468,14 +28476,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "detect_rclone_command_line_usage_filter", "definition": "search *", @@ -28593,12 +28593,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -28607,6 +28601,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_regasm_spawning_a_process_filter", "definition": "search *", @@ -28849,12 +28849,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "process_regasm", "definition": "(Processes.process_name=regasm.exe OR Processes.original_file_name=RegAsm.exe)", @@ -28869,6 +28863,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_regasm_with_no_command_line_arguments_filter", "definition": "search *", @@ -28986,12 +28986,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -29000,6 +28994,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_regsvcs_spawning_a_process_filter", "definition": "search *", @@ -29241,6 +29241,14 @@ "mitre_attack_groups": [] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_regsvcs", "definition": "(Processes.process_name=regsvcs.exe OR Processes.original_file_name=RegSvcs.exe)", @@ -29253,14 +29261,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "detect_regsvcs_with_no_command_line_arguments_filter", "definition": "search *", @@ -29393,6 +29393,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_regsvr32", "definition": "(Processes.process_name=regsvr32.exe OR Processes.original_file_name=REGSVR32.EXE)", @@ -29405,14 +29413,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "detect_regsvr32_application_control_bypass_filter", "definition": "search *", @@ -29557,12 +29557,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -29571,6 +29565,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_renamed_7_zip_filter", "definition": "search *", @@ -29708,12 +29708,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -29722,6 +29716,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_renamed_psexec_filter", "definition": "search *", @@ -29840,12 +29840,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -29854,6 +29848,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_renamed_rclone_filter", "definition": "search *", @@ -29998,12 +29998,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -30012,6 +30006,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_renamed_winrar_filter", "definition": "search *", @@ -30157,12 +30157,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -30171,6 +30165,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_rundll32_application_control_bypass___advpack_filter", "definition": "search *", @@ -30316,12 +30316,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -30330,6 +30324,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_rundll32_application_control_bypass___setupapi_filter", "definition": "search *", @@ -30475,12 +30475,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -30489,6 +30483,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_rundll32_application_control_bypass___syssetup_filter", "definition": "search *", @@ -30606,12 +30606,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -30620,6 +30614,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_rundll32_inline_hta_execution_filter", "definition": "search *", @@ -30748,12 +30748,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -30762,6 +30756,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_sharphound_command_line_arguments_filter", "definition": "search *", @@ -30895,12 +30895,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -30909,6 +30903,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_sharphound_file_modifications_filter", "definition": "search *", @@ -31041,12 +31041,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -31055,6 +31049,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_sharphound_usage_filter", "definition": "search *", @@ -31209,12 +31209,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -31223,6 +31217,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_use_of_cmd_exe_to_launch_script_interpreters_filter", "definition": "search *", @@ -32346,12 +32346,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -32360,6 +32354,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "disable_logs_using_wevtutil_filter", "definition": "search *", @@ -32571,12 +32571,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -32585,6 +32579,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "disable_schedule_task_filter", "definition": "search *", @@ -33735,12 +33735,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "process_netsh", "definition": "(Processes.process_name=netsh.exe OR Processes.original_file_name=netsh.exe)", @@ -33755,6 +33749,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "disabling_firewall_with_netsh_filter", "definition": "search *", @@ -33989,12 +33989,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -34003,6 +33997,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "disabling_net_user_account_filter", "definition": "search *", @@ -34590,12 +34590,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -34604,6 +34598,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "dllhost_with_no_command_line_arguments_with_network_filter", "definition": "search *", @@ -34720,12 +34720,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -34734,6 +34728,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "dns_exfiltration_using_nslookup_app_filter", "definition": "search *", @@ -34854,12 +34854,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -34868,6 +34862,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "domain_account_discovery_with_dsquery_filter", "definition": "search *", @@ -34994,12 +34994,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -35008,6 +35002,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "domain_account_discovery_with_net_app_filter", "definition": "search *", @@ -35127,12 +35127,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -35141,6 +35135,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "domain_account_discovery_with_wmic_filter", "definition": "search *", @@ -35257,12 +35257,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -35271,6 +35265,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "domain_controller_discovery_with_nltest_filter", "definition": "search *", @@ -35387,12 +35387,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -35401,6 +35395,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "domain_controller_discovery_with_wmic_filter", "definition": "search *", @@ -35610,12 +35610,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -35624,6 +35618,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "domain_group_discovery_with_dsquery_filter", "definition": "search *", @@ -35725,12 +35725,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -35739,6 +35733,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "domain_group_discovery_with_net_filter", "definition": "search *", @@ -35840,12 +35840,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -35854,6 +35848,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "domain_group_discovery_with_wmic_filter", "definition": "search *", @@ -36308,12 +36308,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -36322,6 +36316,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "dsquery_domain_discovery_filter", "definition": "search *", @@ -36487,12 +36487,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -36501,6 +36495,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "dump_lsass_via_comsvcs_dll_filter", "definition": "search *", @@ -36662,12 +36662,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -36676,6 +36670,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "dump_lsass_via_procdump_filter", "definition": "search *", @@ -36779,12 +36779,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -36793,6 +36787,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "elevated_group_discovery_with_net_filter", "definition": "search *", @@ -37006,12 +37006,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -37020,6 +37014,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "elevated_group_discovery_with_wmic_filter", "definition": "search *", @@ -37486,6 +37486,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_esentutl", "definition": "(Processes.process_name=esentutl.exe OR Processes.original_file_name=esentutl.exe)", @@ -37498,14 +37506,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "esentutl_sam_copy_filter", "definition": "search *", @@ -37855,10 +37855,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -37867,12 +37869,10 @@ "arguments": null }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null }, { "name": "excel_spawning_powershell_filter", @@ -38001,12 +38001,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -38015,6 +38009,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "excel_spawning_windows_script_host_filter", "definition": "search *", @@ -38111,12 +38111,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -38125,6 +38119,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "excessive_attempt_to_disable_services_filter", "definition": "search *", @@ -38345,12 +38345,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -38359,6 +38353,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "excessive_number_of_distinct_processes_created_in_windows_temp_folder_filter", "definition": "search *", @@ -38471,12 +38471,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -38485,6 +38479,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "excessive_number_of_service_control_start_as_disabled_filter", "definition": "search *", @@ -38602,12 +38602,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -38616,6 +38610,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "excessive_number_of_taskhost_processes_filter", "definition": "search *", @@ -38724,12 +38724,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -38738,6 +38732,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "excessive_service_stop_attempt_filter", "definition": "search *", @@ -38830,12 +38830,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -38844,6 +38838,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "excessive_usage_of_cacls_app_filter", "definition": "search *", @@ -38956,12 +38956,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -38970,6 +38964,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "excessive_usage_of_net_app_filter", "definition": "search *", @@ -39302,12 +39302,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -39316,6 +39310,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "excessive_usage_of_taskkill_filter", "definition": "search *", @@ -39555,12 +39555,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -39569,6 +39563,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "executables_or_script_creation_in_suspicious_path_filter", "definition": "search *", @@ -39727,12 +39727,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -39741,6 +39735,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "execute_javascript_with_jscript_com_clsid_filter", "definition": "search *", @@ -39861,12 +39861,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -39875,6 +39869,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "execution_of_file_with_multiple_extensions_filter", "definition": "search *", @@ -40009,12 +40009,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -40023,6 +40017,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "extraction_of_registry_hives_filter", "definition": "search *", @@ -40118,12 +40118,6 @@ "mitre_attack_groups": null }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -40132,6 +40126,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "file_with_samsam_extension_filter", "definition": "search *", @@ -40231,12 +40231,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -40245,6 +40239,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "firewall_allowed_program_enable_filter", "definition": "search *", @@ -40380,12 +40380,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -40394,6 +40388,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "fodhelper_uac_bypass_filter", "definition": "search *", @@ -40481,12 +40481,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -40495,6 +40489,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "fsutil_zeroing_file_filter", "definition": "search *", @@ -40602,12 +40602,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -40616,6 +40610,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "get_addefaultdomainpasswordpolicy_with_powershell_filter", "definition": "search *", @@ -40845,12 +40845,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -40859,6 +40853,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "get_aduser_with_powershell_filter", "definition": "search *", @@ -41088,12 +41088,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -41102,6 +41096,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "get_aduserresultantpasswordpolicy_with_powershell_filter", "definition": "search *", @@ -41317,12 +41317,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -41331,6 +41325,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "get_domainpolicy_with_powershell_filter", "definition": "search *", @@ -41540,12 +41540,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -41554,6 +41548,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "get_domaintrust_with_powershell_filter", "definition": "search *", @@ -41792,12 +41792,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -41806,6 +41800,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "get_domainuser_with_powershell_filter", "definition": "search *", @@ -42027,12 +42027,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -42041,6 +42035,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "get_foresttrust_with_powershell_filter", "definition": "search *", @@ -42259,12 +42259,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -42273,6 +42267,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "get_wmiobject_group_discovery_filter", "definition": "search *", @@ -42507,12 +42507,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -42521,6 +42515,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "getadcomputer_with_powershell_filter", "definition": "search *", @@ -42744,12 +42744,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -42758,6 +42752,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "getadgroup_with_powershell_filter", "definition": "search *", @@ -42982,12 +42982,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -42996,6 +42990,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "getcurrent_user_with_powershell_filter", "definition": "search *", @@ -43236,12 +43236,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -43250,6 +43244,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "getdomaincomputer_with_powershell_filter", "definition": "search *", @@ -43488,12 +43488,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -43502,6 +43496,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "getdomaincontroller_with_powershell_filter", "definition": "search *", @@ -43725,12 +43725,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -43739,6 +43733,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "getdomaingroup_with_powershell_filter", "definition": "search *", @@ -43940,12 +43940,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -43954,6 +43948,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "getlocaluser_with_powershell_filter", "definition": "search *", @@ -44173,12 +44173,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -44187,6 +44181,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "getnettcpconnection_with_powershell_filter", "definition": "search *", @@ -44421,12 +44421,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -44435,6 +44429,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "getwmiobject_ds_computer_with_powershell_filter", "definition": "search *", @@ -44658,12 +44658,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -44672,6 +44666,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "getwmiobject_ds_group_with_powershell_filter", "definition": "search *", @@ -44898,12 +44898,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -44912,6 +44906,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "getwmiobject_ds_user_with_powershell_filter", "definition": "search *", @@ -45127,12 +45127,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -45141,6 +45135,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "getwmiobject_user_account_with_powershell_filter", "definition": "search *", @@ -45369,12 +45369,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -45383,6 +45377,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "gpupdate_with_no_command_line_arguments_with_network_filter", "definition": "search *", @@ -45611,12 +45611,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -45625,6 +45619,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "hiding_files_and_directories_with_attrib_exe_filter", "definition": "search *", @@ -46163,12 +46163,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -46177,6 +46171,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "icacls_deny_command_filter", "definition": "search *", @@ -46270,12 +46270,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -46284,6 +46278,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "icacls_grant_command_filter", "definition": "search *", @@ -46575,12 +46575,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -46589,6 +46583,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "impacket_lateral_movement_commandline_parameters_filter", "definition": "search *", @@ -46933,12 +46933,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -46947,6 +46941,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "jscript_execution_using_cscript_app_filter", "definition": "search *", @@ -47149,12 +47149,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "wineventlog_system", - "definition": "eventtype=wineventlog_system", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -47163,6 +47157,12 @@ "field" ] }, + { + "name": "wineventlog_system", + "definition": "eventtype=wineventlog_system", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", + "arguments": null + }, { "name": "known_services_killed_by_ransomware_filter", "definition": "search *", @@ -47263,12 +47263,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -47277,6 +47271,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_add_files_in_known_crontab_directories_filter", "definition": "search *", @@ -47383,12 +47383,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -47397,6 +47391,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_add_user_account_filter", "definition": "search *", @@ -47496,12 +47496,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -47510,6 +47504,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_at_allow_config_file_creation_filter", "definition": "search *", @@ -47609,12 +47609,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -47623,6 +47617,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_at_application_execution_filter", "definition": "search *", @@ -47724,12 +47724,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -47738,6 +47732,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_change_file_owner_to_root_filter", "definition": "search *", @@ -47838,12 +47838,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -47852,6 +47846,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_common_process_for_elevation_control_filter", "definition": "search *", @@ -47948,12 +47948,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -47962,6 +47956,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_doas_conf_file_creation_filter", "definition": "search *", @@ -48060,12 +48060,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -48074,6 +48068,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_doas_tool_execution_filter", "definition": "search *", @@ -48175,12 +48175,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -48189,6 +48183,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_edit_cron_table_parameter_filter", "definition": "search *", @@ -48286,12 +48286,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -48300,6 +48294,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_file_created_in_kernel_driver_directory_filter", "definition": "search *", @@ -48397,12 +48397,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -48411,6 +48405,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_file_creation_in_init_boot_directory_filter", "definition": "search *", @@ -48507,12 +48507,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -48521,6 +48515,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_file_creation_in_profile_directory_filter", "definition": "search *", @@ -48620,12 +48620,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -48634,6 +48628,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_insert_kernel_module_using_insmod_utility_filter", "definition": "search *", @@ -48733,12 +48733,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -48747,6 +48741,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_install_kernel_module_using_modprobe_utility_filter", "definition": "search *", @@ -48867,12 +48867,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "linux_shells", "definition": "(Processes.process_name IN (\"sh\", \"ksh\", \"zsh\", \"bash\", \"dash\", \"rbash\", \"fish\", \"csh', \"tcsh', \"ion\", \"eshell\"))", @@ -48887,6 +48881,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_java_spawning_shell_filter", "definition": "search *", @@ -48985,12 +48985,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -48999,6 +48993,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_nopasswd_entry_in_sudoers_file_filter", "definition": "search *", @@ -49126,12 +49126,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -49140,6 +49134,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_pkexec_privilege_escalation_filter", "definition": "search *", @@ -49243,12 +49243,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -49257,6 +49251,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_possible_access_or_modification_of_sshd_config_file_filter", "definition": "search *", @@ -49365,12 +49365,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -49379,6 +49373,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_possible_access_to_credential_files_filter", "definition": "search *", @@ -49477,12 +49477,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -49491,6 +49485,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_possible_access_to_sudoers_file_filter", "definition": "search *", @@ -49590,12 +49590,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -49604,6 +49598,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_possible_append_command_to_at_allow_config_file_filter", "definition": "search *", @@ -49702,12 +49702,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -49716,6 +49710,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_possible_append_command_to_profile_config_file_filter", "definition": "search *", @@ -49819,12 +49819,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -49833,6 +49827,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter", "definition": "search *", @@ -49934,12 +49934,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -49948,6 +49942,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_possible_cronjob_modification_with_editor_filter", "definition": "search *", @@ -50049,12 +50049,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -50063,6 +50057,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_possible_ssh_key_file_creation_filter", "definition": "search *", @@ -50164,12 +50164,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -50178,6 +50172,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_preload_hijack_library_calls_filter", "definition": "search *", @@ -50277,12 +50277,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -50291,6 +50285,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_service_file_created_in_systemd_directory_filter", "definition": "search *", @@ -50389,12 +50389,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -50403,6 +50397,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_service_restarted_filter", "definition": "search *", @@ -50501,12 +50501,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -50515,6 +50509,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_service_started_or_enabled_filter", "definition": "search *", @@ -50612,12 +50612,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -50626,6 +50620,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_setuid_using_chmod_utility_filter", "definition": "search *", @@ -50723,12 +50723,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -50737,6 +50731,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_setuid_using_setcap_utility_filter", "definition": "search *", @@ -50834,12 +50834,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -50848,6 +50842,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_sudo_or_su_execution_filter", "definition": "search *", @@ -50943,12 +50943,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -50957,6 +50951,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_sudoers_tmp_file_creation_filter", "definition": "search *", @@ -51054,12 +51054,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -51068,6 +51062,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "linux_visudo_utility_execution_filter", "definition": "search *", @@ -51297,12 +51297,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -51311,6 +51305,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "local_account_discovery_with_net_filter", "definition": "search *", @@ -51412,12 +51412,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -51426,6 +51420,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "local_account_discovery_with_wmic_filter", "definition": "search *", @@ -51525,12 +51525,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -51539,6 +51533,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "logon_script_event_trigger_execution_filter", "definition": "search *", @@ -51771,12 +51771,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -51785,6 +51779,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "malicious_inprocserver32_modification_filter", "definition": "search *", @@ -51895,12 +51895,6 @@ ] }, "macros": [ - { - "name": "wineventlog_system", - "definition": "eventtype=wineventlog_system", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -51909,6 +51903,12 @@ "field" ] }, + { + "name": "wineventlog_system", + "definition": "eventtype=wineventlog_system", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", + "arguments": null + }, { "name": "malicious_powershell_executed_as_a_service_filter", "definition": "search *", @@ -52075,10 +52075,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -52087,12 +52089,10 @@ "arguments": null }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null }, { "name": "malicious_powershell_process___encoded_command_filter", @@ -52260,10 +52260,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -52272,12 +52274,10 @@ "arguments": null }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null }, { "name": "malicious_powershell_process___execution_policy_bypass_filter", @@ -52444,10 +52444,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -52456,12 +52458,10 @@ "arguments": null }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null }, { "name": "malicious_powershell_process_with_obfuscation_techniques_filter", @@ -52557,12 +52557,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -52571,6 +52565,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "mmc_lolbas_execution_process_spawn_filter", "definition": "search *", @@ -52760,12 +52760,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -52774,6 +52768,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "modify_acl_permission_to_files_or_folder_filter", "definition": "search *", @@ -53231,12 +53231,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "process_msbuild", "definition": "(Processes.process_name=msbuild.exe OR Processes.original_file_name=MSBuild.exe)", @@ -53251,6 +53245,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "msbuild_suspicious_spawned_by_script_process_filter", "definition": "search *", @@ -53366,6 +53366,14 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_regsvr32", "definition": "(Processes.process_name=regsvr32.exe OR Processes.original_file_name=REGSVR32.EXE)", @@ -53378,14 +53386,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "mshta_spawning_rundll32_or_regsvr32_process_filter", "definition": "search *", @@ -53794,12 +53794,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -53808,6 +53802,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "msmpeng_application_dll_side_loading_filter", "definition": "search *", @@ -54786,12 +54786,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -54800,6 +54794,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "net_localgroup_discovery_filter", "definition": "search *", @@ -54899,12 +54899,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -54913,6 +54907,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "net_profiler_uac_bypass_filter", "definition": "search *", @@ -55026,12 +55026,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -55040,6 +55034,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "network_connection_discovery_with_arp_filter", "definition": "search *", @@ -55153,12 +55153,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -55167,6 +55161,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "network_connection_discovery_with_net_filter", "definition": "search *", @@ -55280,12 +55280,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -55294,6 +55288,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "network_connection_discovery_with_netstat_filter", "definition": "search *", @@ -55416,6 +55416,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_route", "definition": "(Processes.process_name=route.exe OR Processes.original_file_name=route.exe)", @@ -55428,14 +55436,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "network_discovery_using_route_windows_app_filter", "definition": "search *", @@ -55596,10 +55596,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -55608,12 +55610,10 @@ "arguments": null }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null }, { "name": "nishang_powershelltcponeline_filter", @@ -55719,12 +55719,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -55733,6 +55727,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "nltest_domain_trust_discovery_filter", "definition": "search *", @@ -56109,12 +56109,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -56123,6 +56117,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "ntdsutil_export_ntds_filter", "definition": "search *", @@ -56449,6 +56449,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_regsvr32", "definition": "(Processes.process_name=regsvr32.exe OR Processes.original_file_name=REGSVR32.EXE)", @@ -56461,14 +56469,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "office_application_spawn_regsvr32_process_filter", "definition": "search *", @@ -56636,12 +56636,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -56650,6 +56644,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "office_application_spawn_rundll32_process_filter", "definition": "search *", @@ -57152,12 +57152,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -57166,6 +57160,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "office_document_spawned_child_process_to_download_filter", "definition": "search *", @@ -57274,6 +57274,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -57286,14 +57294,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "office_product_spawn_cmd_process_filter", "definition": "search *", @@ -57466,12 +57466,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -57480,6 +57474,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "office_product_spawning_bitsadmin_filter", "definition": "search *", @@ -57647,6 +57647,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_certutil", "definition": "(Processes.process_name=certutil.exe OR Processes.original_file_name=CertUtil.exe)", @@ -57659,14 +57667,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "office_product_spawning_certutil_filter", "definition": "search *", @@ -57834,6 +57834,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_mshta", "definition": "(Processes.process_name=mshta.exe OR Processes.original_file_name=MSHTA.EXE)", @@ -57846,14 +57854,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "office_product_spawning_mshta_filter", "definition": "search *", @@ -58028,12 +58028,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -58042,6 +58036,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "office_product_spawning_rundll32_with_no_dll_filter", "definition": "search *", @@ -58217,12 +58217,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -58231,6 +58225,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "office_product_spawning_wmic_filter", "definition": "search *", @@ -58580,12 +58580,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -58594,6 +58588,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "office_spawning_control_filter", "definition": "search *", @@ -58698,12 +58698,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -58712,6 +58706,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "outbound_network_connection_from_java_using_default_ports_filter", "definition": "search *", @@ -58815,12 +58815,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -58829,6 +58823,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "overwriting_accessibility_binaries_filter", "definition": "search *", @@ -58934,12 +58934,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -58948,6 +58942,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "password_policy_discovery_with_net_filter", "definition": "search *", @@ -59042,12 +59042,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -59056,6 +59050,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "permission_modification_using_takeown_app_filter", "definition": "search *", @@ -59375,9 +59375,9 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", + "name": "process_ping", + "definition": "(Processes.process_name=ping.exe OR Processes.original_file_name=ping.exe)", + "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, { @@ -59389,9 +59389,9 @@ ] }, { - "name": "process_ping", - "definition": "(Processes.process_name=ping.exe OR Processes.original_file_name=ping.exe)", - "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", "arguments": null }, { @@ -59514,12 +59514,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -59528,6 +59522,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "possible_browser_pass_view_parameter_filter", "definition": "search *", @@ -59711,12 +59711,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -59725,6 +59719,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "possible_lateral_movement_powershell_spawn_filter", "definition": "search *", @@ -59879,12 +59879,6 @@ "description": "Performs the tokenization and application of the malicious commandline classifier", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -59893,6 +59887,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "potentially_malicious_code_on_commandline_filter", "definition": "search *", @@ -60248,10 +60248,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -60260,12 +60262,10 @@ "arguments": null }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null }, { "name": "powershell___connect_to_internet_with_hidden_window_filter", @@ -60550,10 +60550,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -60562,12 +60564,10 @@ "arguments": null }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null }, { "name": "powershell_disable_security_monitoring_filter", @@ -61493,12 +61493,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -61507,6 +61501,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "powershell_get_localgroup_discovery_filter", "definition": "search *", @@ -62326,10 +62326,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -62338,12 +62340,10 @@ "arguments": null }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null }, { "name": "powershell_start_bitstransfer_filter", @@ -62694,12 +62694,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -62708,6 +62702,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "prevent_automatic_repair_mode_using_bcdedit_filter", "definition": "search *", @@ -63057,12 +63057,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -63071,6 +63065,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "process_creating_lnk_file_in_suspicious_location_filter", "definition": "search *", @@ -63309,12 +63309,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -63323,6 +63317,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "process_execution_via_wmi_filter", "definition": "search *", @@ -63444,12 +63444,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -63458,6 +63452,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "process_kill_base_on_file_path_filter", "definition": "search *", @@ -63580,12 +63580,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -63594,6 +63588,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "process_writing_dynamicwrapperx_filter", "definition": "search *", @@ -63703,12 +63703,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "process_netsh", "definition": "(Processes.process_name=netsh.exe OR Processes.original_file_name=netsh.exe)", @@ -63723,6 +63717,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "processes_launching_netsh_filter", "definition": "search *", @@ -64179,6 +64179,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -64191,14 +64199,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "recursive_delete_of_directory_in_batch_cmd_filter", "definition": "search *", @@ -64304,12 +64304,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -64318,6 +64312,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "reg_exe_manipulating_windows_services_registry_keys_filter", "definition": "search *", @@ -64811,6 +64811,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_regsvr32", "definition": "(Processes.process_name=regsvr32.exe OR Processes.original_file_name=REGSVR32.EXE)", @@ -64823,14 +64831,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "regsvr32_silent_and_install_param_dll_loading_filter", "definition": "search *", @@ -64957,6 +64957,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_regsvr32", "definition": "(Processes.process_name=regsvr32.exe OR Processes.original_file_name=REGSVR32.EXE)", @@ -64969,14 +64977,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "regsvr32_with_known_silent_switch_cmdline_filter", "definition": "search *", @@ -65182,12 +65182,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -65196,6 +65190,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "remcos_rat_file_creation_in_remcos_folder_filter", "definition": "search *", @@ -65290,10 +65290,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -65302,12 +65304,10 @@ "arguments": null }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null }, { "name": "remote_process_instantiation_via_dcom_and_powershell_filter", @@ -65506,10 +65506,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -65518,12 +65520,10 @@ "arguments": null }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null }, { "name": "remote_process_instantiation_via_winrm_and_powershell_filter", @@ -65726,12 +65726,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -65740,6 +65734,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "remote_process_instantiation_via_winrm_and_winrs_filter", "definition": "search *", @@ -65880,12 +65880,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -65894,6 +65888,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "remote_process_instantiation_via_wmi_filter", "definition": "search *", @@ -66012,10 +66012,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -66024,12 +66026,10 @@ "arguments": null }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null }, { "name": "remote_process_instantiation_via_wmi_and_powershell_filter", @@ -66393,12 +66393,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -66407,6 +66401,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "remote_system_discovery_with_dsquery_filter", "definition": "search *", @@ -66523,12 +66523,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -66537,6 +66531,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "remote_system_discovery_with_net_filter", "definition": "search *", @@ -66654,12 +66654,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -66668,6 +66662,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "remote_system_discovery_with_wmic_filter", "definition": "search *", @@ -66801,12 +66801,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -66815,6 +66809,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "remote_wmi_command_attempt_filter", "definition": "search *", @@ -66910,12 +66910,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -66924,6 +66918,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "resize_shadowstorage_volume_filter", "definition": "search *", @@ -67020,12 +67020,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -67034,6 +67028,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "revil_common_exec_parameter_filter", "definition": "search *", @@ -67246,12 +67246,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "process_runas", "definition": "(Processes.process_name=runas.exe OR Processes.original_file_name=runas.exe)", @@ -67266,6 +67260,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "runas_execution_in_commandline_filter", "definition": "search *", @@ -67407,12 +67407,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -67421,6 +67415,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "rundll32_control_rundll_hunt_filter", "definition": "search *", @@ -67562,12 +67562,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -67576,6 +67570,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "rundll32_control_rundll_world_writable_directory_filter", "definition": "search *", @@ -68186,12 +68186,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -68200,6 +68194,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "rundll32_shimcache_flush_filter", "definition": "search *", @@ -68327,12 +68327,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -68341,6 +68335,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "rundll32_with_no_command_line_arguments_with_network_filter", "definition": "search *", @@ -68436,12 +68436,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -68450,6 +68444,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "ryuk_test_files_detected_filter", "definition": "search *", @@ -68609,12 +68609,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -68623,6 +68617,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "ryuk_wake_on_lan_command_filter", "definition": "search *", @@ -68854,12 +68854,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -68868,6 +68862,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "samsam_test_file_write_filter", "definition": "search *", @@ -68995,12 +68995,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -69009,6 +69003,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "sc_exe_manipulating_windows_services_filter", "definition": "search *", @@ -69433,12 +69433,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -69447,6 +69441,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "scheduled_task_creation_on_remote_endpoint_using_at_filter", "definition": "search *", @@ -69585,12 +69585,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -69599,6 +69593,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "scheduled_task_deleted_or_created_via_cmd_filter", "definition": "search *", @@ -69733,12 +69733,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -69747,6 +69741,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "scheduled_task_initiation_on_remote_endpoint_filter", "definition": "search *", @@ -69841,12 +69841,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -69855,6 +69849,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "schtasks_run_task_on_demand_filter", "definition": "search *", @@ -69992,12 +69992,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -70006,6 +70000,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "schtasks_scheduling_job_on_remote_system_filter", "definition": "search *", @@ -70143,12 +70143,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -70157,6 +70151,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "schtasks_used_for_forcing_a_reboot_filter", "definition": "search *", @@ -70253,12 +70253,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -70267,6 +70261,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "screensaver_event_trigger_execution_filter", "definition": "search *", @@ -70390,12 +70390,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -70404,6 +70398,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "script_execution_via_wmi_filter", "definition": "search *", @@ -70651,12 +70651,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "process_sdelete", "definition": "(Processes.process_name=sdelete.exe OR Processes.original_file_name=sdelete.exe)", @@ -70671,6 +70665,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "sdelete_application_execution_filter", "definition": "search *", @@ -70775,12 +70775,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -70789,6 +70783,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "searchprotocolhost_with_no_command_line_with_network_filter", "definition": "search *", @@ -70904,12 +70904,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -70918,6 +70912,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "secretdumps_offline_ntds_dumping_tool_filter", "definition": "search *", @@ -71184,9 +71184,9 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", + "name": "process_setspn", + "definition": "(Processes.process_name=setspn.exe OR Processes.original_file_name=setspn.exe)", + "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, { @@ -71198,9 +71198,9 @@ ] }, { - "name": "process_setspn", - "definition": "(Processes.process_name=setspn.exe OR Processes.original_file_name=setspn.exe)", - "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", "arguments": null }, { @@ -71299,12 +71299,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -71313,6 +71307,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "services_escalate_exe_filter", "definition": "search *", @@ -71428,12 +71428,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -71442,6 +71436,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "services_lolbas_execution_process_spawn_filter", "definition": "search *", @@ -71603,12 +71603,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -71617,6 +71611,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter", "definition": "search *", @@ -71712,12 +71712,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -71726,6 +71720,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "shim_database_file_creation_filter", "definition": "search *", @@ -71823,12 +71823,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -71837,6 +71831,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "shim_database_installation_with_suspicious_parameters_filter", "definition": "search *", @@ -72076,12 +72076,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -72090,6 +72084,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "short_lived_windows_accounts_filter", "definition": "search *", @@ -72358,12 +72358,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -72372,6 +72366,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "single_letter_process_on_endpoint_filter", "definition": "search *", @@ -72483,12 +72483,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -72497,6 +72491,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "slui_runas_elevated_filter", "definition": "search *", @@ -72606,12 +72606,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -72620,6 +72614,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "slui_spawning_a_process_filter", "definition": "search *", @@ -72738,12 +72738,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -72752,6 +72746,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "spoolsv_spawning_rundll32_filter", "definition": "search *", @@ -73757,6 +73757,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_copy", "definition": "(Processes.process_name=copy.exe OR Processes.original_file_name=copy.exe OR Processes.process_name=xcopy.exe OR Processes.original_file_name=xcopy.exe)", @@ -73769,14 +73777,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "suspicious_copy_on_system32_filter", "definition": "search *", @@ -73890,6 +73890,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_dllhost", "definition": "(Processes.process_name=dllhost.exe OR Processes.original_file_name=dllhost.exe)", @@ -73902,14 +73910,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "suspicious_dllhost_no_command_line_arguments_filter", "definition": "search *", @@ -74276,12 +74276,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "process_gpupdate", "definition": "(Processes.process_name=gpupdate.exe OR Processes.original_file_name=GPUpdate.exe)", @@ -74296,6 +74290,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "suspicious_gpupdate_no_command_line_arguments_filter", "definition": "search *", @@ -74418,12 +74418,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -74432,6 +74426,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "suspicious_icedid_rundll32_cmdline_filter", "definition": "search *", @@ -74805,6 +74805,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_microsoftworkflowcompiler", "definition": "(Processes.process_name=microsoft.workflow.compiler.exe OR Processes.original_file_name=Microsoft.Workflow.Compiler.exe)", @@ -74817,14 +74825,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "suspicious_microsoft_workflow_compiler_rename_filter", "definition": "search *", @@ -74928,6 +74928,14 @@ "mitre_attack_groups": [] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_microsoftworkflowcompiler", "definition": "(Processes.process_name=microsoft.workflow.compiler.exe OR Processes.original_file_name=Microsoft.Workflow.Compiler.exe)", @@ -74940,14 +74948,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "suspicious_microsoft_workflow_compiler_usage_filter", "definition": "search *", @@ -75075,12 +75075,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "process_msbuild", "definition": "(Processes.process_name=msbuild.exe OR Processes.original_file_name=MSBuild.exe)", @@ -75095,6 +75089,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "suspicious_msbuild_path_filter", "definition": "search *", @@ -75223,12 +75223,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "process_msbuild", "definition": "(Processes.process_name=msbuild.exe OR Processes.original_file_name=MSBuild.exe)", @@ -75243,6 +75237,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "suspicious_msbuild_rename_filter", "definition": "search *", @@ -75351,12 +75351,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "process_msbuild", "definition": "(Processes.process_name=msbuild.exe OR Processes.original_file_name=MSBuild.exe)", @@ -75371,6 +75365,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "suspicious_msbuild_spawn_filter", "definition": "search *", @@ -75487,12 +75487,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -75501,6 +75495,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "suspicious_mshta_child_process_filter", "definition": "search *", @@ -75610,6 +75610,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_mshta", "definition": "(Processes.process_name=mshta.exe OR Processes.original_file_name=MSHTA.EXE)", @@ -75622,14 +75630,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "suspicious_mshta_spawn_filter", "definition": "search *", @@ -75886,12 +75886,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -75900,6 +75894,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "suspicious_process_file_path_filter", "definition": "search *", @@ -76183,12 +76183,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -76197,6 +76191,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "suspicious_reg_exe_process_filter", "definition": "search *", @@ -76317,6 +76317,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_regsvr32", "definition": "(Processes.process_name=regsvr32.exe OR Processes.original_file_name=REGSVR32.EXE)", @@ -76329,14 +76337,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "suspicious_regsvr32_register_suspicious_path_filter", "definition": "search *", @@ -76471,12 +76471,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -76485,6 +76479,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "suspicious_rundll32_dllregisterserver_filter", "definition": "search *", @@ -76607,12 +76607,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -76621,6 +76615,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "suspicious_rundll32_plugininit_filter", "definition": "search *", @@ -76756,12 +76756,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -76770,6 +76764,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "suspicious_rundll32_startw_filter", "definition": "search *", @@ -76904,12 +76904,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -76918,6 +76912,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "suspicious_rundll32_no_command_line_arguments_filter", "definition": "search *", @@ -77059,12 +77059,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -77073,6 +77067,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "suspicious_scheduled_task_from_public_directory_filter", "definition": "search *", @@ -77185,12 +77185,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -77199,6 +77193,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "suspicious_searchprotocolhost_no_command_line_arguments_filter", "definition": "search *", @@ -77564,12 +77564,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -77578,6 +77572,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "suspicious_wevtutil_usage_filter", "definition": "search *", @@ -77827,12 +77827,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -77841,6 +77835,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "svchost_lolbas_execution_process_spawn_filter", "definition": "search *", @@ -77944,12 +77944,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -77958,6 +77952,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "system_info_gathering_using_dxdiag_application_filter", "definition": "search *", @@ -78092,12 +78092,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -78106,6 +78100,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "system_information_discovery_detection_filter", "definition": "search *", @@ -78231,12 +78231,6 @@ "description": "This macro limits the output to process names that are in the Windows System directory", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -78245,6 +78239,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "system_processes_run_from_unexpected_locations_filter", "definition": "search *", @@ -78363,12 +78363,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -78377,6 +78371,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "system_user_discovery_with_query_filter", "definition": "search *", @@ -78495,12 +78495,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -78509,6 +78503,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "system_user_discovery_with_whoami_filter", "definition": "search *", @@ -79075,12 +79075,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -79089,6 +79083,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "unified_messaging_service_spawning_a_process_filter", "definition": "search *", @@ -79191,12 +79191,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -79205,6 +79199,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "uninstall_app_using_msiexec_filter", "definition": "search *", @@ -79310,12 +79310,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -79324,6 +79318,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "unload_sysmon_filter_driver_filter", "definition": "search *", @@ -79542,12 +79542,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -79556,6 +79550,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "user_discovery_with_env_vars_powershell_filter", "definition": "search *", @@ -79777,12 +79777,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -79791,6 +79785,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "usn_journal_deletion_filter", "definition": "search *", @@ -79939,12 +79939,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -79953,6 +79947,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "vbscript_execution_using_wscript_app_filter", "definition": "search *", @@ -80059,12 +80059,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -80073,6 +80067,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "verclsid_clsid_execution_filter", "definition": "search *", @@ -80192,18 +80192,20 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "process_powershell", "definition": "(Processes.process_name=pwsh.exe OR Processes.process_name=sqlps.exe OR Processes.process_name=sqltoolsps.exe OR Processes.process_name=powershell.exe OR Processes.process_name=powershell_ise.exe OR Processes.original_file_name=pwsh.dll OR Processes.original_file_name=PowerShell.EXE OR Processes.original_file_name=powershell_ise.EXE)", @@ -80211,12 +80213,10 @@ "arguments": null }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null }, { "name": "w3wp_spawning_shell_filter", @@ -80310,12 +80310,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -80324,6 +80318,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "wbadmin_delete_system_backups_filter", "definition": "search *", @@ -80810,18 +80810,20 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "process_powershell", "definition": "(Processes.process_name=pwsh.exe OR Processes.process_name=sqlps.exe OR Processes.process_name=sqltoolsps.exe OR Processes.process_name=powershell.exe OR Processes.process_name=powershell_ise.exe OR Processes.original_file_name=pwsh.dll OR Processes.original_file_name=PowerShell.EXE OR Processes.original_file_name=powershell_ise.EXE)", @@ -80829,12 +80831,10 @@ "arguments": null }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null }, { "name": "wermgr_process_spawned_cmd_or_powershell_process_filter", @@ -81005,12 +81005,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -81019,6 +81013,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "wget_download_and_bash_execution_filter", "definition": "search *", @@ -81138,12 +81138,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -81152,6 +81146,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "windows_adfind_exe_filter", "definition": "search *", @@ -81330,10 +81330,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_curl", @@ -81342,12 +81344,10 @@ "arguments": null }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null }, { "name": "windows_curl_download_to_suspicious_path_filter", @@ -81526,10 +81526,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_curl", @@ -81538,12 +81540,10 @@ "arguments": null }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null }, { "name": "windows_curl_upload_to_remote_destination_filter", @@ -81772,12 +81772,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -81786,6 +81780,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "windows_disableantispyware_registry_filter", "definition": "search *", @@ -81904,12 +81904,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -81918,6 +81912,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "windows_diskcryptor_usage_filter", "definition": "search *", @@ -82047,12 +82047,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -82061,6 +82055,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "windows_dism_remove_defender_filter", "definition": "search *", @@ -82206,12 +82206,6 @@ "description": "This macro limits the output to process names that are .net binaries on Windows Server 2016 and Windows 11.", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -82220,6 +82214,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "windows_dotnet_binary_in_non_standard_path_filter", "definition": "search *", @@ -82335,12 +82335,6 @@ "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", "arguments": null }, - { - "name": "wineventlog_system", - "definition": "eventtype=wineventlog_system", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -82349,6 +82343,12 @@ "field" ] }, + { + "name": "wineventlog_system", + "definition": "eventtype=wineventlog_system", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", + "arguments": null + }, { "name": "windows_event_log_cleared_filter", "definition": "search *", @@ -82789,12 +82789,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -82803,6 +82797,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "windows_installutil_in_non_standard_path_filter", "definition": "search *", @@ -82928,12 +82928,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -82942,6 +82936,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "windows_installutil_remote_network_connection_filter", "definition": "search *", @@ -83066,12 +83066,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -83080,6 +83074,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "windows_installutil_uninstall_option_filter", "definition": "search *", @@ -83207,12 +83207,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -83221,6 +83215,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "windows_installutil_uninstall_option_with_network_filter", "definition": "search *", @@ -83344,12 +83344,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -83358,6 +83352,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "windows_installutil_url_in_command_line_filter", "definition": "search *", @@ -83523,12 +83523,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -83537,6 +83531,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "windows_nirsoft_advancedrun_filter", "definition": "search *", @@ -83707,12 +83707,6 @@ "description": "This macro is related to potentially identifiable software related to NirSoft. Remove or filter as needed based.", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -83721,6 +83715,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "windows_nirsoft_utilities_filter", "definition": "search *", @@ -84181,12 +84181,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -84195,6 +84189,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "windows_raccine_scheduled_task_deletion_filter", "definition": "search *", @@ -84297,12 +84297,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -84311,6 +84305,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "windows_security_account_manager_stopped_filter", "definition": "search *", @@ -84418,12 +84418,6 @@ ] }, "macros": [ - { - "name": "wineventlog_system", - "definition": "eventtype=wineventlog_system", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -84432,6 +84426,12 @@ "field" ] }, + { + "name": "wineventlog_system", + "definition": "eventtype=wineventlog_system", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", + "arguments": null + }, { "name": "windows_service_created_with_suspicious_service_path_filter", "definition": "search *", @@ -84545,12 +84545,6 @@ ] }, "macros": [ - { - "name": "wineventlog_system", - "definition": "eventtype=wineventlog_system", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -84559,6 +84553,12 @@ "field" ] }, + { + "name": "wineventlog_system", + "definition": "eventtype=wineventlog_system", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", + "arguments": null + }, { "name": "windows_service_created_within_public_path_filter", "definition": "search *", @@ -84674,12 +84674,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -84688,6 +84682,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "windows_service_creation_on_remote_endpoint_filter", "definition": "search *", @@ -84802,12 +84802,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -84816,6 +84810,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "windows_service_initiation_on_remote_endpoint_filter", "definition": "search *", @@ -85390,12 +85390,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -85404,6 +85398,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "winhlp32_spawning_a_process_filter", "definition": "search *", @@ -85577,6 +85577,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -85589,14 +85597,6 @@ "description": "search data model's summaries only", "arguments": null }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "winword_spawning_cmd_filter", "definition": "search *", @@ -85774,10 +85774,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -85786,12 +85788,10 @@ "arguments": null }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null }, { "name": "winword_spawning_powershell_filter", @@ -85961,12 +85961,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -85975,6 +85969,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "winword_spawning_windows_script_host_filter", "definition": "search *", @@ -86312,12 +86312,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -86326,6 +86320,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "wmic_group_discovery_filter", "definition": "search *", @@ -86448,12 +86448,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -86462,6 +86456,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "wmic_noninteractive_app_uninstallation_filter", "definition": "search *", @@ -86584,12 +86584,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -86598,6 +86592,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "wmic_xsl_execution_via_url_filter", "definition": "search *", @@ -86716,12 +86716,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -86730,6 +86724,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "wmiprsve_lolbas_execution_process_spawn_filter", "definition": "search *", @@ -86853,12 +86853,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -86867,6 +86861,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "wscript_or_cscript_suspicious_child_process_filter", "definition": "search *", @@ -86966,12 +86966,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -86980,6 +86974,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "wsmprovhost_lolbas_execution_process_spawn_filter", "definition": "search *", @@ -87328,12 +87328,6 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -87342,6 +87336,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "xsl_script_execution_with_wmic_filter", "definition": "search *", @@ -87424,12 +87424,6 @@ "mitre_attack_groups": null }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -87438,6 +87432,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_new_login_attempts_to_routers_filter", "definition": "search *", @@ -87514,12 +87514,6 @@ "mitre_attack_groups": null }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -87528,6 +87522,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "email_attachments_with_lots_of_spaces_filter", "definition": "search *", @@ -87614,12 +87614,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -87628,6 +87622,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "email_files_written_outside_of_the_outlook_directory_filter", "definition": "search *", @@ -87804,12 +87804,6 @@ "mitre_attack_groups": null }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -87818,6 +87812,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "monitor_email_for_brand_abuse_filter", "definition": "search *", @@ -87935,12 +87935,6 @@ ] }, "macros": [ - { - "name": "okta", - "definition": "eventtype=okta_log", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -87949,6 +87943,12 @@ "field" ] }, + { + "name": "okta", + "definition": "eventtype=okta_log", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", + "arguments": null + }, { "name": "multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter", "definition": "search *", @@ -88023,12 +88023,6 @@ "mitre_attack_groups": null }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -88037,6 +88031,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "no_windows_updates_in_a_time_frame_filter", "definition": "search *", @@ -88272,12 +88272,6 @@ ] }, "macros": [ - { - "name": "okta", - "definition": "eventtype=okta_log", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -88286,6 +88280,12 @@ "field" ] }, + { + "name": "okta", + "definition": "eventtype=okta_log", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", + "arguments": null + }, { "name": "okta_failed_sso_attempts_filter", "definition": "search *", @@ -88400,12 +88400,6 @@ ] }, "macros": [ - { - "name": "okta", - "definition": "eventtype=okta_log", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -88414,6 +88408,12 @@ "field" ] }, + { + "name": "okta", + "definition": "eventtype=okta_log", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", + "arguments": null + }, { "name": "okta_user_logins_from_multiple_cities_filter", "definition": "search *", @@ -88572,12 +88572,6 @@ "description": "This macro limits the output to email attachments that have suspicious extensions", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -88586,6 +88580,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "suspicious_email_attachment_extensions_filter", "definition": "search *", @@ -88810,12 +88810,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -88824,6 +88818,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "web_servers_executing_suspicious_processes_filter", "definition": "search *", @@ -91086,12 +91086,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -91100,6 +91094,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "child_processes_of_spoolsv_exe_filter", "definition": "search *", @@ -91660,12 +91660,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -91674,6 +91668,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_outlook_exe_writing_a_zip_file_filter", "definition": "search *", @@ -91762,12 +91762,6 @@ "mitre_attack_groups": null }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "filter_rare_process_allow_list", "definition": "lookup update=true lookup_rare_process_allow_list_default process as process OUTPUTNEW allow_list | where allow_list=\"false\" | lookup update=true lookup_rare_process_allow_list_local process as process OUTPUT allow_list | where allow_list=\"false\"", @@ -91782,6 +91776,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_rare_executables_filter", "definition": "search *", @@ -91868,12 +91868,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -91882,6 +91876,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detection_of_tools_built_by_nirsoft_filter", "definition": "search *", @@ -91982,12 +91982,6 @@ ] }, "macros": [ - { - "name": "exchange", - "definition": "sourcetype=\"MSWindows:IIS\"", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -91996,6 +91990,12 @@ "field" ] }, + { + "name": "exchange", + "definition": "sourcetype=\"MSWindows:IIS\"", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", + "arguments": null + }, { "name": "exchange_powershell_abuse_via_ssrf_filter", "definition": "search *", @@ -92281,12 +92281,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -92301,6 +92295,12 @@ "description": "Use this macro to determine how far back you should be checking for new zoom child processes", "arguments": null }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "first_time_seen_child_process_of_zoom_filter", "definition": "search *", @@ -92497,12 +92497,6 @@ "mitre_attack_groups": null }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -92511,6 +92505,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "macos___re_opened_applications_filter", "definition": "search *", @@ -92752,12 +92752,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -92766,6 +92760,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "print_processor_registry_autostart_filter", "definition": "search *", @@ -93207,12 +93207,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -93221,6 +93215,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "remote_desktop_process_running_on_system_filter", "definition": "search *", @@ -93579,12 +93579,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -93593,6 +93587,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "suspicious_curl_network_connection_filter", "definition": "search *", @@ -93684,12 +93684,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -93698,6 +93692,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "suspicious_plistbuddy_usage_filter", "definition": "search *", @@ -93871,12 +93871,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -93885,6 +93879,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "suspicious_sqlite3_lsquarantine_behavior_filter", "definition": "search *", @@ -94215,12 +94215,6 @@ "mitre_attack_groups": null }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -94229,6 +94223,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "unusually_long_command_line_filter", "definition": "search *", @@ -94312,12 +94312,6 @@ "mitre_attack_groups": null }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -94326,6 +94320,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "unusually_long_command_line___mltk_filter", "definition": "search *", @@ -94452,12 +94452,6 @@ "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", "arguments": null }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -94466,6 +94460,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "windows_java_spawning_shells_filter", "definition": "search *", @@ -94574,12 +94574,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -94588,6 +94582,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "winrm_spawning_a_process_filter", "definition": "search *", @@ -95161,12 +95161,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -95175,6 +95169,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_large_outbound_icmp_packets_filter", "definition": "search *", @@ -95272,12 +95272,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -95286,6 +95280,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_outbound_smb_traffic_filter", "definition": "search *", @@ -95706,12 +95706,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -95720,6 +95714,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_software_download_to_network_device_filter", "definition": "search *", @@ -96021,14 +96021,14 @@ }, "macros": [ { - "name": "stream_dns", - "definition": "sourcetype=stream:dns", + "name": "stream_tcp", + "definition": "sourcetype=stream:tcp", "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", "arguments": null }, { - "name": "stream_tcp", - "definition": "sourcetype=stream:tcp", + "name": "stream_dns", + "definition": "sourcetype=stream:dns", "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.", "arguments": null }, @@ -96356,12 +96356,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -96370,6 +96364,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "dns_query_length_outliers___mltk_filter", "definition": "search *", @@ -96754,12 +96754,6 @@ "mitre_attack_groups": [] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -96768,6 +96762,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "prohibited_network_traffic_allowed_filter", "definition": "search *", @@ -96862,12 +96862,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -96876,6 +96870,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "protocol_or_port_mismatch_filter", "definition": "search *", @@ -96967,12 +96967,6 @@ "mitre_attack_groups": null }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -96981,6 +96975,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "protocols_passing_authentication_in_cleartext_filter", "definition": "search *", @@ -97214,12 +97214,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -97228,6 +97222,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "remote_desktop_network_traffic_filter", "definition": "search *", @@ -97579,12 +97579,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -97593,6 +97587,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "tor_traffic_filter", "definition": "search *", @@ -97796,12 +97796,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -97810,6 +97804,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_attackers_scanning_for_vulnerable_jboss_servers_filter", "definition": "search *", @@ -97994,12 +97994,6 @@ "mitre_attack_groups": null }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -98008,6 +98002,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_malicious_requests_to_exploit_jboss_servers_filter", "definition": "search *", @@ -98081,10 +98081,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "brand_abuse_web", @@ -98093,12 +98095,10 @@ "arguments": null }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null }, { "name": "monitor_web_traffic_for_brand_abuse_filter", @@ -98465,12 +98465,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "dynamic_dns_providers", "definition": "lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True", @@ -98485,6 +98479,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "detect_hosts_connecting_to_dynamic_domain_providers_filter", "definition": "search *", @@ -99213,12 +99213,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only", - "arguments": null - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -99227,6 +99221,12 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only", + "arguments": null + }, { "name": "log4shell_jndi_payload_injection_with_outbound_connection_filter", "definition": "search *", diff --git a/dist/api/stories.json b/dist/api/stories.json index 9906f6046a..96277ad3a9 100644 --- a/dist/api/stories.json +++ b/dist/api/stories.json @@ -294,11 +294,6 @@ "definition": "(Processes.process_name=\"net.exe\" OR Processes.original_file_name=\"net.exe\" OR Processes.process_name=\"net1.exe\" OR Processes.original_file_name=\"net1.exe\")", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -307,6 +302,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "account_discovery_with_net_app_filter", "definition": "search *", @@ -514,11 +514,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -527,6 +522,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "chcp_command_execution_filter", "definition": "search *", @@ -782,6 +782,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -792,14 +800,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "cmd_carry_out_string_command_parameter_filter", "definition": "search *", @@ -1203,11 +1203,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -1216,6 +1211,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "disable_schedule_task_filter", "definition": "search *", @@ -1938,11 +1938,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -1951,6 +1946,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "fodhelper_uac_bypass_filter", "definition": "search *", @@ -2393,6 +2393,14 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_regsvr32", "definition": "(Processes.process_name=regsvr32.exe OR Processes.original_file_name=REGSVR32.EXE)", @@ -2403,14 +2411,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "mshta_spawning_rundll32_or_regsvr32_process_filter", "definition": "search *", @@ -2619,11 +2619,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -2632,6 +2627,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "nltest_domain_trust_discovery_filter", "definition": "search *", @@ -2878,6 +2878,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_regsvr32", "definition": "(Processes.process_name=regsvr32.exe OR Processes.original_file_name=REGSVR32.EXE)", @@ -2888,14 +2896,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "office_application_spawn_regsvr32_process_filter", "definition": "search *", @@ -3151,11 +3151,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -3164,6 +3159,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "office_application_spawn_rundll32_process_filter", "definition": "search *", @@ -3690,6 +3690,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_mshta", "definition": "(Processes.process_name=mshta.exe OR Processes.original_file_name=MSHTA.EXE)", @@ -3700,14 +3708,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "office_product_spawning_mshta_filter", "definition": "search *", @@ -4236,6 +4236,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_regsvr32", "definition": "(Processes.process_name=regsvr32.exe OR Processes.original_file_name=REGSVR32.EXE)", @@ -4246,14 +4254,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "regsvr32_with_known_silent_switch_cmdline_filter", "definition": "search *", @@ -5770,11 +5770,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -5783,6 +5778,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_icedid_rundll32_cmdline_filter", "definition": "search *", @@ -6002,11 +6002,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -6015,6 +6010,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_rundll32_plugininit_filter", "definition": "search *", @@ -7057,11 +7057,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -7070,6 +7065,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "domain_account_discovery_with_dsquery_filter", "definition": "search *", @@ -7305,11 +7305,6 @@ "definition": "(Processes.process_name=\"net.exe\" OR Processes.original_file_name=\"net.exe\" OR Processes.process_name=\"net1.exe\" OR Processes.original_file_name=\"net1.exe\")", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -7318,6 +7313,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "domain_account_discovery_with_net_app_filter", "definition": "search *", @@ -7547,11 +7547,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -7560,6 +7555,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "domain_account_discovery_with_wmic_filter", "definition": "search *", @@ -7762,11 +7762,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -7775,6 +7770,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "domain_controller_discovery_with_nltest_filter", "definition": "search *", @@ -7970,11 +7970,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -7983,6 +7978,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "domain_controller_discovery_with_wmic_filter", "definition": "search *", @@ -8360,11 +8360,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -8373,6 +8368,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "domain_group_discovery_with_dsquery_filter", "definition": "search *", @@ -8555,11 +8555,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -8568,6 +8563,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "domain_group_discovery_with_net_filter", "definition": "search *", @@ -8750,11 +8750,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -8763,6 +8758,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "domain_group_discovery_with_wmic_filter", "definition": "search *", @@ -8998,11 +8998,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -9011,6 +9006,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "dsquery_domain_discovery_filter", "definition": "search *", @@ -9202,11 +9202,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -9215,6 +9210,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "elevated_group_discovery_with_net_filter", "definition": "search *", @@ -9596,11 +9596,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -9609,6 +9604,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "elevated_group_discovery_with_wmic_filter", "definition": "search *", @@ -9817,11 +9817,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -9830,6 +9825,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "get_addefaultdomainpasswordpolicy_with_powershell_filter", "definition": "search *", @@ -10251,11 +10251,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -10264,6 +10259,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "get_aduser_with_powershell_filter", "definition": "search *", @@ -10692,11 +10692,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -10705,6 +10700,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "get_aduserresultantpasswordpolicy_with_powershell_filter", "definition": "search *", @@ -11124,11 +11124,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -11137,6 +11132,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "get_domainpolicy_with_powershell_filter", "definition": "search *", @@ -11539,11 +11539,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -11552,6 +11547,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "get_domaintrust_with_powershell_filter", "definition": "search *", @@ -12007,11 +12007,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -12020,6 +12015,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "get_domainuser_with_powershell_filter", "definition": "search *", @@ -12436,11 +12436,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -12449,6 +12444,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "get_foresttrust_with_powershell_filter", "definition": "search *", @@ -12855,11 +12855,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -12868,6 +12863,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "get_wmiobject_group_discovery_filter", "definition": "search *", @@ -13271,11 +13271,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -13284,6 +13279,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "getadcomputer_with_powershell_filter", "definition": "search *", @@ -13664,11 +13664,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -13677,6 +13672,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "getadgroup_with_powershell_filter", "definition": "search *", @@ -14058,11 +14058,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -14071,6 +14066,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "getcurrent_user_with_powershell_filter", "definition": "search *", @@ -14473,11 +14473,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -14486,6 +14481,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "getdomaincomputer_with_powershell_filter", "definition": "search *", @@ -14886,11 +14886,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -14899,6 +14894,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "getdomaincontroller_with_powershell_filter", "definition": "search *", @@ -15293,11 +15293,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -15306,6 +15301,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "getdomaingroup_with_powershell_filter", "definition": "search *", @@ -15673,11 +15673,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -15686,6 +15681,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "getlocaluser_with_powershell_filter", "definition": "search *", @@ -16062,11 +16062,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -16075,6 +16070,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "getnettcpconnection_with_powershell_filter", "definition": "search *", @@ -16471,11 +16471,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -16484,6 +16479,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "getwmiobject_ds_computer_with_powershell_filter", "definition": "search *", @@ -16878,11 +16878,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -16891,6 +16886,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "getwmiobject_ds_group_with_powershell_filter", "definition": "search *", @@ -17313,11 +17313,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -17326,6 +17321,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "getwmiobject_ds_user_with_powershell_filter", "definition": "search *", @@ -17719,11 +17719,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -17732,6 +17727,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "getwmiobject_user_account_with_powershell_filter", "definition": "search *", @@ -18098,11 +18098,6 @@ "definition": "(Processes.process_name=\"net.exe\" OR Processes.original_file_name=\"net.exe\" OR Processes.process_name=\"net1.exe\" OR Processes.original_file_name=\"net1.exe\")", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -18111,6 +18106,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "local_account_discovery_with_net_filter", "definition": "search *", @@ -18292,11 +18292,6 @@ "definition": "(Processes.process_name=wmic.exe OR Processes.original_file_name=wmic.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -18305,6 +18300,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "local_account_discovery_with_wmic_filter", "definition": "search *", @@ -18511,11 +18511,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -18524,6 +18519,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "net_localgroup_discovery_filter", "definition": "search *", @@ -18716,11 +18716,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -18729,6 +18724,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "network_connection_discovery_with_arp_filter", "definition": "search *", @@ -18901,11 +18901,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -18914,6 +18909,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "network_connection_discovery_with_net_filter", "definition": "search *", @@ -19106,11 +19106,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -19119,6 +19114,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "network_connection_discovery_with_netstat_filter", "definition": "search *", @@ -19322,6 +19322,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_route", "definition": "(Processes.process_name=route.exe OR Processes.original_file_name=route.exe)", @@ -19332,14 +19340,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "network_discovery_using_route_windows_app_filter", "definition": "search *", @@ -19548,11 +19548,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -19561,6 +19556,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "nltest_domain_trust_discovery_filter", "definition": "search *", @@ -19767,11 +19767,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -19780,6 +19775,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "password_policy_discovery_with_net_filter", "definition": "search *", @@ -19982,11 +19982,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -19995,6 +19990,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "powershell_get_localgroup_discovery_filter", "definition": "search *", @@ -20609,11 +20609,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -20622,6 +20617,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "remote_system_discovery_with_dsquery_filter", "definition": "search *", @@ -20817,11 +20817,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -20830,6 +20825,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "remote_system_discovery_with_net_filter", "definition": "search *", @@ -21033,11 +21033,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -21046,6 +21041,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "remote_system_discovery_with_wmic_filter", "definition": "search *", @@ -21549,9 +21549,9 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "process_setspn", + "definition": "(Processes.process_name=setspn.exe OR Processes.original_file_name=setspn.exe)", + "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { "name": "security_content_ctime", @@ -21562,9 +21562,9 @@ ] }, { - "name": "process_setspn", - "definition": "(Processes.process_name=setspn.exe OR Processes.original_file_name=setspn.exe)", - "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "serviceprincipalnames_discovery_with_setspn_filter", @@ -21763,11 +21763,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -21776,6 +21771,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "system_user_discovery_with_query_filter", "definition": "search *", @@ -21973,11 +21973,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -21986,6 +21981,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "system_user_discovery_with_whoami_filter", "definition": "search *", @@ -22183,11 +22183,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -22196,6 +22191,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "user_discovery_with_env_vars_powershell_filter", "definition": "search *", @@ -22603,11 +22603,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -22616,6 +22611,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "wmic_group_discovery_filter", "definition": "search *", @@ -23241,11 +23241,6 @@ "definition": "(Processes.process_name=psexec.exe OR Processes.process_name=psexec64.exe OR Processes.original_file_name=psexec.c)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -23254,6 +23249,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_psexec_with_accepteula_flag_filter", "definition": "search *", @@ -23508,11 +23508,6 @@ "definition": "(Processes.process_name=psexec.exe OR Processes.process_name=psexec64.exe OR Processes.original_file_name=psexec.c)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -23521,6 +23516,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_renamed_psexec_filter", "definition": "search *", @@ -24011,11 +24011,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -24024,6 +24019,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "impacket_lateral_movement_commandline_parameters_filter", "definition": "search *", @@ -24369,11 +24369,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -24382,6 +24377,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "mmc_lolbas_execution_process_spawn_filter", "definition": "search *", @@ -24663,11 +24663,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -24676,6 +24671,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "possible_lateral_movement_powershell_spawn_filter", "definition": "search *", @@ -24857,9 +24857,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -24867,12 +24870,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "remote_process_instantiation_via_dcom_and_powershell_filter", @@ -25244,9 +25244,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -25254,12 +25257,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "remote_process_instantiation_via_winrm_and_powershell_filter", @@ -25635,11 +25635,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -25648,6 +25643,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "remote_process_instantiation_via_winrm_and_winrs_filter", "definition": "search *", @@ -25908,11 +25908,6 @@ "definition": "(Processes.process_name=wmic.exe OR Processes.original_file_name=wmic.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -25921,6 +25916,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "remote_process_instantiation_via_wmi_filter", "definition": "search *", @@ -26124,9 +26124,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -26134,12 +26137,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "remote_process_instantiation_via_wmi_and_powershell_filter", @@ -26533,11 +26533,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -26546,6 +26541,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "scheduled_task_creation_on_remote_endpoint_using_at_filter", "definition": "search *", @@ -26767,11 +26767,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -26780,6 +26775,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "scheduled_task_initiation_on_remote_endpoint_filter", "definition": "search *", @@ -27031,11 +27031,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -27044,6 +27039,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "schtasks_scheduling_job_on_remote_system_filter", "definition": "search *", @@ -27226,11 +27226,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -27239,6 +27234,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "services_lolbas_execution_process_spawn_filter", "definition": "search *", @@ -27662,11 +27662,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -27675,6 +27670,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "svchost_lolbas_execution_process_spawn_filter", "definition": "search *", @@ -27881,11 +27881,6 @@ ] }, "macros": [ - { - "name": "wineventlog_system", - "definition": "eventtype=wineventlog_system", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -27894,6 +27889,11 @@ "field" ] }, + { + "name": "wineventlog_system", + "definition": "eventtype=wineventlog_system", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." + }, { "name": "windows_service_created_with_suspicious_service_path_filter", "definition": "search *", @@ -28105,11 +28105,6 @@ ] }, "macros": [ - { - "name": "wineventlog_system", - "definition": "eventtype=wineventlog_system", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -28118,6 +28113,11 @@ "field" ] }, + { + "name": "wineventlog_system", + "definition": "eventtype=wineventlog_system", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." + }, { "name": "windows_service_created_within_public_path_filter", "definition": "search *", @@ -28320,11 +28320,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -28333,6 +28328,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_service_creation_on_remote_endpoint_filter", "definition": "search *", @@ -28534,11 +28534,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -28547,6 +28542,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_service_initiation_on_remote_endpoint_filter", "definition": "search *", @@ -28989,11 +28989,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -29002,6 +28997,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "wmiprsve_lolbas_execution_process_spawn_filter", "definition": "search *", @@ -29168,11 +29168,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -29181,6 +29176,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "wsmprovhost_lolbas_execution_process_spawn_filter", "definition": "search *", @@ -29765,11 +29765,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -29778,6 +29773,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "remote_desktop_process_running_on_system_filter", "definition": "search *", @@ -30502,11 +30502,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -30515,6 +30510,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "remote_desktop_network_traffic_filter", "definition": "search *", @@ -32555,11 +32555,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -32568,6 +32563,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "web_servers_executing_suspicious_processes_filter", "definition": "search *", @@ -37154,16 +37154,16 @@ ] }, "macros": [ - { - "name": "network_acl_events", - "definition": "(eventName = CreateNetworkAcl OR eventName = CreateNetworkAclEntry OR eventName = DeleteNetworkAcl OR eventName = DeleteNetworkAclEntry OR eventName = ReplaceNetworkAclEntry OR eventName = ReplaceNetworkAclAssociation)", - "description": "This is a list of AWS event names that are associated with Network ACLs" - }, { "name": "cloudtrail", "definition": "sourcetype=aws:cloudtrail", "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." }, + { + "name": "network_acl_events", + "definition": "(eventName = CreateNetworkAcl OR eventName = CreateNetworkAclEntry OR eventName = DeleteNetworkAcl OR eventName = DeleteNetworkAclEntry OR eventName = ReplaceNetworkAclEntry OR eventName = ReplaceNetworkAclAssociation)", + "description": "This is a list of AWS event names that are associated with Network ACLs" + }, { "name": "detect_spike_in_network_acl_activity_filter", "definition": "search *", @@ -40670,11 +40670,6 @@ "definition": "(Processes.process_name=bitsadmin.exe OR Processes.original_file_name=bitsadmin.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -40683,6 +40678,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "bits_job_persistence_filter", "definition": "search *", @@ -40994,11 +40994,6 @@ "definition": "(Processes.process_name=bitsadmin.exe OR Processes.original_file_name=bitsadmin.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -41007,6 +41002,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "bitsadmin_download_file_filter", "definition": "search *", @@ -41209,9 +41209,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -41219,12 +41222,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "powershell_start_bitstransfer_filter", @@ -41449,11 +41449,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "brand_abuse_dns", "definition": "lookup update=true brandMonitoring_lookup domain as query OUTPUT domain_abuse | search domain_abuse=true", @@ -41467,6 +41462,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "monitor_dns_for_brand_abuse_filter", "definition": "search *", @@ -41660,11 +41660,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -41673,6 +41668,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "monitor_email_for_brand_abuse_filter", "definition": "search *", @@ -41864,9 +41864,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "brand_abuse_web", @@ -41874,12 +41877,9 @@ "description": "This macro limits the output to only domains that are in the brand monitoring lookup file" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "monitor_web_traffic_for_brand_abuse_filter", @@ -42521,11 +42521,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -42534,6 +42529,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "cloud_compute_instance_created_by_previously_unseen_user_filter", "definition": "search *", @@ -45917,11 +45917,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -45930,6 +45925,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "certutil_exe_certificate_extraction_filter", "definition": "search *", @@ -46632,11 +46632,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "filter_rare_process_allow_list", "definition": "lookup update=true lookup_rare_process_allow_list_default process as process OUTPUTNEW allow_list | where allow_list=\"false\" | lookup update=true lookup_rare_process_allow_list_local process as process OUTPUT allow_list | where allow_list=\"false\"", @@ -46650,6 +46645,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_rare_executables_filter", "definition": "search *", @@ -46970,11 +46970,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -46983,6 +46978,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "anomalous_usage_of_7zip_filter", "definition": "search *", @@ -47293,6 +47293,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -47303,14 +47311,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "cmd_echo_pipe___escalation_filter", "definition": "search *", @@ -47822,6 +47822,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_regsvr32", "definition": "(Processes.process_name=regsvr32.exe OR Processes.original_file_name=REGSVR32.EXE)", @@ -47832,14 +47840,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "detect_regsvr32_application_control_bypass_filter", "definition": "search *", @@ -48079,11 +48079,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -48092,6 +48087,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "dllhost_with_no_command_line_arguments_with_network_filter", "definition": "search *", @@ -48331,11 +48331,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -48344,6 +48339,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "gpupdate_with_no_command_line_arguments_with_network_filter", "definition": "search *", @@ -48570,11 +48570,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -48583,6 +48578,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "rundll32_with_no_command_line_arguments_with_network_filter", "definition": "search *", @@ -48783,11 +48783,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -48796,6 +48791,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "searchprotocolhost_with_no_command_line_with_network_filter", "definition": "search *", @@ -48989,11 +48989,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -49002,6 +48997,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "services_escalate_exe_filter", "definition": "search *", @@ -49214,6 +49214,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_dllhost", "definition": "(Processes.process_name=dllhost.exe OR Processes.original_file_name=dllhost.exe)", @@ -49224,14 +49232,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "suspicious_dllhost_no_command_line_arguments_filter", "definition": "search *", @@ -49444,11 +49444,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "process_gpupdate", "definition": "(Processes.process_name=gpupdate.exe OR Processes.original_file_name=GPUpdate.exe)", @@ -49462,6 +49457,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_gpupdate_no_command_line_arguments_filter", "definition": "search *", @@ -49681,6 +49681,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_microsoftworkflowcompiler", "definition": "(Processes.process_name=microsoft.workflow.compiler.exe OR Processes.original_file_name=Microsoft.Workflow.Compiler.exe)", @@ -49691,14 +49699,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "suspicious_microsoft_workflow_compiler_rename_filter", "definition": "search *", @@ -49928,11 +49928,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "process_msbuild", "definition": "(Processes.process_name=msbuild.exe OR Processes.original_file_name=MSBuild.exe)", @@ -49946,6 +49941,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_msbuild_path_filter", "definition": "search *", @@ -50176,11 +50176,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "process_msbuild", "definition": "(Processes.process_name=msbuild.exe OR Processes.original_file_name=MSBuild.exe)", @@ -50194,6 +50189,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_msbuild_rename_filter", "definition": "search *", @@ -50427,11 +50427,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -50440,6 +50435,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_rundll32_startw_filter", "definition": "search *", @@ -50672,11 +50672,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -50685,6 +50680,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_rundll32_no_command_line_arguments_filter", "definition": "search *", @@ -50896,11 +50896,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -50909,6 +50904,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_searchprotocolhost_no_command_line_arguments_filter", "definition": "search *", @@ -51264,11 +51264,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -51277,6 +51272,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "macos___re_opened_applications_filter", "definition": "search *", @@ -52025,11 +52025,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -52038,6 +52033,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_renamed_7_zip_filter", "definition": "search *", @@ -52296,11 +52296,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -52309,6 +52304,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_renamed_winrar_filter", "definition": "search *", @@ -52687,11 +52687,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -52700,6 +52695,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "email_files_written_outside_of_the_outlook_directory_filter", "definition": "search *", @@ -53725,11 +53725,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -53738,6 +53733,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_long_dns_txt_record_response_filter", "definition": "search *", @@ -54358,11 +54358,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -54371,6 +54366,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "dns_exfiltration_using_nslookup_app_filter", "definition": "search *", @@ -54930,11 +54930,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -54943,6 +54938,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_large_outbound_icmp_packets_filter", "definition": "search *", @@ -55181,11 +55181,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -55194,6 +55189,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "dns_query_length_outliers___mltk_filter", "definition": "search *", @@ -55603,11 +55603,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -55616,6 +55611,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "prohibited_network_traffic_allowed_filter", "definition": "search *", @@ -55787,11 +55787,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -55800,6 +55795,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "protocol_or_port_mismatch_filter", "definition": "search *", @@ -56013,11 +56013,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -56026,6 +56021,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "tor_traffic_filter", "definition": "search *", @@ -56262,11 +56262,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "dynamic_dns_providers", "definition": "lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True", @@ -56280,6 +56275,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_hosts_connecting_to_dynamic_domain_providers_filter", "definition": "search *", @@ -58848,6 +58848,14 @@ "definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -58858,14 +58866,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "attempted_credential_dump_from_registry_via_reg_exe_filter", "definition": "search *", @@ -59681,11 +59681,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -59694,6 +59689,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "creation_of_shadow_copy_filter", "definition": "search *", @@ -59974,9 +59974,12 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -59984,12 +59987,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "creation_of_shadow_copy_with_wmic_and_powershell_filter", @@ -60265,6 +60265,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -60275,14 +60283,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "credential_dumping_via_copy_command_from_shadow_copy_filter", "definition": "search *", @@ -60557,6 +60557,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -60567,14 +60575,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "credential_dumping_via_symlink_to_shadow_copy_filter", "definition": "search *", @@ -61699,11 +61699,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -61712,6 +61707,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "dump_lsass_via_comsvcs_dll_filter", "definition": "search *", @@ -62012,11 +62012,6 @@ "definition": "(Processes.process_name=procdump.exe OR Processes.process_name=procdump64.exe OR Processes.original_file_name=procdump)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -62025,6 +62020,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "dump_lsass_via_procdump_filter", "definition": "search *", @@ -62495,6 +62495,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_esentutl", "definition": "(Processes.process_name=esentutl.exe OR Processes.original_file_name=esentutl.exe)", @@ -62505,14 +62513,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "esentutl_sam_copy_filter", "definition": "search *", @@ -62759,11 +62759,6 @@ "definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -62772,6 +62767,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "extraction_of_registry_hives_filter", "definition": "search *", @@ -62972,11 +62972,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -62985,6 +62980,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "ntdsutil_export_ntds_filter", "definition": "search *", @@ -63444,11 +63444,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -63457,6 +63452,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "secretdumps_offline_ntds_dumping_tool_filter", "definition": "search *", @@ -63736,11 +63736,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -63749,6 +63744,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter", "definition": "search *", @@ -65899,11 +65899,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -65912,6 +65907,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "dns_exfiltration_using_nslookup_app_filter", "definition": "search *", @@ -67362,11 +67362,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -67375,6 +67370,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_usb_device_insertion_filter", "definition": "search *", @@ -67793,11 +67793,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "dynamic_dns_providers", "definition": "lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True", @@ -67811,6 +67806,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_hosts_connecting_to_dynamic_domain_providers_filter", "definition": "search *", @@ -68400,6 +68400,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_certutil", "definition": "(Processes.process_name=certutil.exe OR Processes.original_file_name=CertUtil.exe)", @@ -68410,14 +68418,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "certutil_with_decode_argument_filter", "definition": "search *", @@ -71329,14 +71329,24 @@ }, "macros": [ { - "name": "evilginx_phishlets_aws", - "definition": "(query=www* AND query=aws* AND query=console.aws* AND query=signin.aws* AND api-northeast-1.console.aws* AND query=fls-na* AND query=images-na*)", - "description": "This limits the query fields to domains that are associated with evilginx masquerading as an AWS console" + "name": "evilginx_phishlets_facebook", + "definition": "(query=www* AND query = m* AND query=static*)", + "description": "This limits the query fields to domains that are associated with evilginx masquerading as FaceBook" }, { - "name": "evilginx_phishlets_0365", - "definition": "(query=login* AND query=www*)", - "description": "This limits the query fields to domains that are associated with evilginx masquerading as Office 365" + "name": "evilginx_phishlets_amazon", + "definition": "(query=fls-na* AND query = www* AND query=images*)", + "description": "This limits the query fields to domains that are associated with evilginx masquerading as Amazon" + }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, + { + "name": "evilginx_phishlets_google", + "definition": "(query=accounts* AND query=ssl* AND query=www*)", + "description": "This limits the query fields to domains that are associated with evilginx masquerading as Google" }, { "name": "evilginx_phishlets_outlook", @@ -71349,24 +71359,14 @@ "description": "This limits the query fields to domains that are associated with evilginx masquerading as GitHub" }, { - "name": "evilginx_phishlets_facebook", - "definition": "(query=www* AND query = m* AND query=static*)", - "description": "This limits the query fields to domains that are associated with evilginx masquerading as FaceBook" + "name": "evilginx_phishlets_0365", + "definition": "(query=login* AND query=www*)", + "description": "This limits the query fields to domains that are associated with evilginx masquerading as Office 365" }, { - "name": "evilginx_phishlets_google", - "definition": "(query=accounts* AND query=ssl* AND query=www*)", - "description": "This limits the query fields to domains that are associated with evilginx masquerading as Google" - }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, - { - "name": "evilginx_phishlets_amazon", - "definition": "(query=fls-na* AND query = www* AND query=images*)", - "description": "This limits the query fields to domains that are associated with evilginx masquerading as Amazon" + "name": "evilginx_phishlets_aws", + "definition": "(query=www* AND query=aws* AND query=console.aws* AND query=signin.aws* AND api-northeast-1.console.aws* AND query=fls-na* AND query=images-na*)", + "description": "This limits the query fields to domains that are associated with evilginx masquerading as an AWS console" }, { "name": "detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter", @@ -71987,11 +71987,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -72000,6 +71995,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_hosts_file_modification_filter", "definition": "search *", @@ -73502,11 +73502,6 @@ ] }, "macros": [ - { - "name": "netbackup", - "definition": "sourcetype=\"netbackup_logs\"", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -73515,6 +73510,11 @@ "field" ] }, + { + "name": "netbackup", + "definition": "sourcetype=\"netbackup_logs\"", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." + }, { "name": "extended_period_without_successful_netbackup_backups_filter", "definition": "search *", @@ -73745,11 +73745,6 @@ ] }, "macros": [ - { - "name": "netbackup", - "definition": "sourcetype=\"netbackup_logs\"", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -73758,6 +73753,11 @@ "field" ] }, + { + "name": "netbackup", + "definition": "sourcetype=\"netbackup_logs\"", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." + }, { "name": "unsuccessful_netbackup_backups_filter", "definition": "search *", @@ -74132,11 +74132,6 @@ "definition": "lookup prohibited_softwares app as process_name OUTPUT is_prohibited | search is_prohibited=True", "description": "This macro limits the output to process_names that have been marked as prohibited" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -74145,6 +74140,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "prohibited_software_on_endpoint_filter", "definition": "search *", @@ -74464,11 +74464,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -74477,6 +74472,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "attacker_tools_on_endpoint_filter", "definition": "search *", @@ -74951,11 +74951,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -74964,6 +74959,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "spectre_and_meltdown_vulnerable_systems_filter", "definition": "search *", @@ -77531,16 +77531,16 @@ ] }, "macros": [ - { - "name": "ec2_modification_api_calls", - "definition": "(eventName=AssociateAddress OR eventName=AssociateIamInstanceProfile OR eventName=AttachClassicLinkVpc OR eventName=AttachNetworkInterface OR eventName=AttachVolume OR eventName=BundleInstance OR eventName=DetachClassicLinkVpc OR eventName=DetachVolume OR eventName=ModifyInstanceAttribute OR eventName=ModifyInstancePlacement OR eventName=MonitorInstances OR eventName=RebootInstances OR eventName=ResetInstanceAttribute OR eventName=StartInstances OR eventName=StopInstances OR eventName=TerminateInstances OR eventName=UnmonitorInstances)", - "description": "This is a list of AWS event names that have to do with modifying Amazon EC2 instances" - }, { "name": "cloudtrail", "definition": "sourcetype=aws:cloudtrail", "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." }, + { + "name": "ec2_modification_api_calls", + "definition": "(eventName=AssociateAddress OR eventName=AssociateIamInstanceProfile OR eventName=AttachClassicLinkVpc OR eventName=AttachNetworkInterface OR eventName=AttachVolume OR eventName=BundleInstance OR eventName=DetachClassicLinkVpc OR eventName=DetachVolume OR eventName=ModifyInstanceAttribute OR eventName=ModifyInstancePlacement OR eventName=MonitorInstances OR eventName=RebootInstances OR eventName=ResetInstanceAttribute OR eventName=StartInstances OR eventName=StopInstances OR eventName=TerminateInstances OR eventName=UnmonitorInstances)", + "description": "This is a list of AWS event names that have to do with modifying Amazon EC2 instances" + }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -80981,11 +80981,6 @@ ] }, "macros": [ - { - "name": "aws_ecr_users", - "definition": "userName IN (user)", - "description": "specify the user allowed to push Images to AWS ECR." - }, { "name": "cloudtrail", "definition": "sourcetype=aws:cloudtrail", @@ -80999,6 +80994,11 @@ "field" ] }, + { + "name": "aws_ecr_users", + "definition": "userName IN (user)", + "description": "specify the user allowed to push Images to AWS ECR." + }, { "name": "aws_ecr_container_upload_unknown_user_filter", "definition": "search *", @@ -81177,11 +81177,6 @@ ] }, "macros": [ - { - "name": "circleci", - "definition": "sourcetype=circleci", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -81190,6 +81185,11 @@ "field" ] }, + { + "name": "circleci", + "definition": "sourcetype=circleci", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." + }, { "name": "circle_ci_disable_security_job_filter", "definition": "search *", @@ -81368,11 +81368,6 @@ ] }, "macros": [ - { - "name": "circleci", - "definition": "sourcetype=circleci", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -81381,6 +81376,11 @@ "field" ] }, + { + "name": "circleci", + "definition": "sourcetype=circleci", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." + }, { "name": "circle_ci_disable_security_step_filter", "definition": "search *", @@ -81883,11 +81883,6 @@ ] }, "macros": [ - { - "name": "github", - "definition": "sourcetype=aws:firehose:json", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -81896,6 +81891,11 @@ "field" ] }, + { + "name": "github", + "definition": "sourcetype=aws:firehose:json", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." + }, { "name": "github_commit_changes_in_master_filter", "definition": "search *", @@ -82058,11 +82058,6 @@ ] }, "macros": [ - { - "name": "github", - "definition": "sourcetype=aws:firehose:json", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -82071,6 +82066,11 @@ "field" ] }, + { + "name": "github", + "definition": "sourcetype=aws:firehose:json", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." + }, { "name": "github_commit_in_develop_filter", "definition": "search *", @@ -82267,11 +82267,6 @@ ] }, "macros": [ - { - "name": "github", - "definition": "sourcetype=aws:firehose:json", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -82280,6 +82275,11 @@ "field" ] }, + { + "name": "github", + "definition": "sourcetype=aws:firehose:json", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." + }, { "name": "github_dependabot_alert_filter", "definition": "search *", @@ -82475,9 +82475,9 @@ }, "macros": [ { - "name": "github", - "definition": "sourcetype=aws:firehose:json", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." + "name": "github_known_users", + "definition": "user IN (user_names_here)", + "description": "specify the user allowed to create PRs in Github projects." }, { "name": "security_content_ctime", @@ -82488,9 +82488,9 @@ ] }, { - "name": "github_known_users", - "definition": "user IN (user_names_here)", - "description": "specify the user allowed to create PRs in Github projects." + "name": "github", + "definition": "sourcetype=aws:firehose:json", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." }, { "name": "github_pull_request_from_unknown_user_filter", @@ -84899,11 +84899,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -84912,6 +84907,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "first_time_seen_command_line_argument_filter", "definition": "search *", @@ -85191,11 +85191,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -85204,6 +85199,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "create_local_admin_accounts_using_net_exe_filter", "definition": "search *", @@ -85742,11 +85742,6 @@ "definition": "(Processes.process_name=psexec.exe OR Processes.process_name=psexec64.exe OR Processes.original_file_name=psexec.c)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -85755,6 +85750,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_psexec_with_accepteula_flag_filter", "definition": "search *", @@ -86009,11 +86009,6 @@ "definition": "(Processes.process_name=psexec.exe OR Processes.process_name=psexec64.exe OR Processes.original_file_name=psexec.c)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -86022,6 +86017,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_renamed_psexec_filter", "definition": "search *", @@ -86302,9 +86302,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -86312,12 +86315,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "malicious_powershell_process___execution_policy_bypass_filter", @@ -86587,11 +86587,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "process_netsh", "definition": "(Processes.process_name=netsh.exe OR Processes.original_file_name=netsh.exe)", @@ -86605,6 +86600,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "processes_launching_netsh_filter", "definition": "search *", @@ -87145,11 +87145,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -87158,6 +87153,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "sc_exe_manipulating_windows_services_filter", "definition": "search *", @@ -87390,11 +87390,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -87403,6 +87398,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "scheduled_task_deleted_or_created_via_cmd_filter", "definition": "search *", @@ -87681,11 +87681,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -87694,6 +87689,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "single_letter_process_on_endpoint_filter", "definition": "search *", @@ -87925,11 +87925,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -87938,6 +87933,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_reg_exe_process_filter", "definition": "search *", @@ -88115,11 +88115,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -88128,6 +88123,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_outbound_smb_traffic_filter", "definition": "search *", @@ -89188,6 +89188,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_certutil", "definition": "(Processes.process_name=certutil.exe OR Processes.original_file_name=CertUtil.exe)", @@ -89198,14 +89206,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "attempt_to_add_certificate_to_untrusted_store_filter", "definition": "search *", @@ -89499,11 +89499,6 @@ "definition": "(Processes.process_name=\"net.exe\" OR Processes.original_file_name=\"net.exe\" OR Processes.process_name=\"net1.exe\" OR Processes.original_file_name=\"net1.exe\")", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -89512,6 +89507,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "attempt_to_stop_security_service_filter", "definition": "search *", @@ -89780,11 +89780,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "process_netsh", "definition": "(Processes.process_name=netsh.exe OR Processes.original_file_name=netsh.exe)", @@ -89798,6 +89793,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "processes_launching_netsh_filter", "definition": "search *", @@ -90055,11 +90055,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -90068,6 +90063,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "sc_exe_manipulating_windows_services_filter", "definition": "search *", @@ -90299,11 +90299,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -90312,6 +90307,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_reg_exe_process_filter", "definition": "search *", @@ -90518,11 +90518,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -90531,6 +90526,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "unload_sysmon_filter_driver_filter", "definition": "search *", @@ -91987,11 +91987,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "dynamic_dns_providers", "definition": "lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True", @@ -92005,6 +92000,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_hosts_connecting_to_dynamic_domain_providers_filter", "definition": "search *", @@ -93016,11 +93016,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -93029,6 +93024,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "dsquery_domain_discovery_filter", "definition": "search *", @@ -93237,11 +93237,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -93250,6 +93245,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "nltest_domain_trust_discovery_filter", "definition": "search *", @@ -93471,11 +93471,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -93484,6 +93479,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_adfind_exe_filter", "definition": "search *", @@ -93746,11 +93746,6 @@ "definition": "lookup update=true dynamic_dns_providers_default dynamic_dns_domains as url OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as url OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True", "description": "This is a description" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -93759,6 +93754,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_web_traffic_to_dynamic_domain_providers_filter", "definition": "search *", @@ -93997,11 +93997,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -94010,6 +94005,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "dns_exfiltration_using_nslookup_app_filter", "definition": "search *", @@ -94432,11 +94432,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "dynamic_dns_providers", "definition": "lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True", @@ -94450,6 +94445,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_hosts_connecting_to_dynamic_domain_providers_filter", "definition": "search *", @@ -94937,11 +94937,6 @@ "definition": "lookup prohibited_softwares app as process_name OUTPUT is_prohibited | search is_prohibited=True", "description": "This macro limits the output to process_names that have been marked as prohibited" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -94950,6 +94945,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "prohibited_software_on_endpoint_filter", "definition": "search *", @@ -95210,11 +95210,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -95223,6 +95218,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_use_of_cmd_exe_to_launch_script_interpreters_filter", "definition": "search *", @@ -95643,11 +95643,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -95656,6 +95651,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "email_attachments_with_lots_of_spaces_filter", "definition": "search *", @@ -95892,11 +95892,6 @@ "definition": "lookup update=true is_suspicious_file_extension_lookup file_name OUTPUT suspicious | search suspicious=true", "description": "This macro limits the output to email attachments that have suspicious extensions" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -95905,6 +95900,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_email_attachment_extensions_filter", "definition": "search *", @@ -96079,11 +96079,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "filter_rare_process_allow_list", "definition": "lookup update=true lookup_rare_process_allow_list_default process as process OUTPUTNEW allow_list | where allow_list=\"false\" | lookup update=true lookup_rare_process_allow_list_local process as process OUTPUT allow_list | where allow_list=\"false\"", @@ -96097,6 +96092,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_rare_executables_filter", "definition": "search *", @@ -96259,11 +96259,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -96272,6 +96267,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detection_of_tools_built_by_nirsoft_filter", "definition": "search *", @@ -97598,11 +97598,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -97611,6 +97606,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "check_elevated_cmd_using_whoami_filter", "definition": "search *", @@ -97873,11 +97873,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -97886,6 +97881,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "cmdline_tool_not_executed_in_cmd_shell_filter", "definition": "search *", @@ -98110,11 +98110,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -98123,6 +98118,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "jscript_execution_using_cscript_app_filter", "definition": "search *", @@ -99534,11 +99534,6 @@ "definition": "(Processes.process_name=wmic.exe OR Processes.original_file_name=wmic.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -99547,6 +99542,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "office_product_spawning_wmic_filter", "definition": "search *", @@ -99795,11 +99795,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -99808,6 +99803,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "vbscript_execution_using_wscript_app_filter", "definition": "search *", @@ -100037,11 +100037,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -100050,6 +100045,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "wscript_or_cscript_suspicious_child_process_filter", "definition": "search *", @@ -100289,11 +100289,6 @@ "definition": "(Processes.process_name=wmic.exe OR Processes.original_file_name=wmic.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -100302,6 +100297,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "xsl_script_execution_with_wmic_filter", "definition": "search *", @@ -101748,9 +101748,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -101758,12 +101761,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "any_powershell_downloadstring_filter", @@ -102538,11 +102538,6 @@ "definition": "(Processes.process_name=psexec.exe OR Processes.process_name=psexec64.exe OR Processes.original_file_name=psexec.c)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -102551,6 +102546,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_psexec_with_accepteula_flag_filter", "definition": "search *", @@ -102805,11 +102805,6 @@ "definition": "(Processes.process_name=psexec.exe OR Processes.process_name=psexec64.exe OR Processes.original_file_name=psexec.c)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -102818,6 +102813,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_renamed_psexec_filter", "definition": "search *", @@ -103123,11 +103123,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -103136,6 +103131,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "dump_lsass_via_comsvcs_dll_filter", "definition": "search *", @@ -103436,11 +103436,6 @@ "definition": "(Processes.process_name=procdump.exe OR Processes.process_name=procdump64.exe OR Processes.original_file_name=procdump)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -103449,6 +103444,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "dump_lsass_via_procdump_filter", "definition": "search *", @@ -103729,9 +103729,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -103739,12 +103742,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "malicious_powershell_process___execution_policy_bypass_filter", @@ -103994,9 +103994,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -104004,12 +104007,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "nishang_powershelltcponeline_filter", @@ -104211,11 +104211,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -104224,6 +104219,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "ntdsutil_export_ntds_filter", "definition": "search *", @@ -104536,9 +104536,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -104546,12 +104549,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "powershell___connect_to_internet_with_hidden_window_filter", @@ -104832,11 +104832,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -104845,6 +104840,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter", "definition": "search *", @@ -105037,11 +105037,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -105050,6 +105045,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "unified_messaging_service_spawning_a_process_filter", "definition": "search *", @@ -105258,28 +105258,28 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "process_powershell", "definition": "(Processes.process_name=pwsh.exe OR Processes.process_name=sqlps.exe OR Processes.process_name=sqltoolsps.exe OR Processes.process_name=powershell.exe OR Processes.process_name=powershell_ise.exe OR Processes.original_file_name=pwsh.dll OR Processes.original_file_name=PowerShell.EXE OR Processes.original_file_name=powershell_ise.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "w3wp_spawning_shell_filter", @@ -105837,11 +105837,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -105850,6 +105845,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "first_time_seen_command_line_argument_filter", "definition": "search *", @@ -106002,11 +106002,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "suspicious_writes", "definition": "lookup suspicious_writes_lookup file as file_name OUTPUT note as \"Reference\" | search \"Reference\" != False", @@ -106020,6 +106015,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_file_write_filter", "definition": "search *", @@ -106283,11 +106283,6 @@ "definition": "(Processes.process_name=\"net.exe\" OR Processes.original_file_name=\"net.exe\" OR Processes.process_name=\"net1.exe\" OR Processes.original_file_name=\"net1.exe\")", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -106296,6 +106291,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "create_or_delete_windows_shares_using_net_exe_filter", "definition": "search *", @@ -106504,11 +106504,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -106517,6 +106512,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "remote_desktop_process_running_on_system_filter", "definition": "search *", @@ -106694,11 +106694,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -106707,6 +106702,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_outbound_smb_traffic_filter", "definition": "search *", @@ -106945,11 +106945,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -106958,6 +106953,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "dns_query_length_outliers___mltk_filter", "definition": "search *", @@ -107328,11 +107328,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -107341,6 +107336,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "remote_desktop_network_traffic_filter", "definition": "search *", @@ -109063,9 +109063,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -109073,12 +109076,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "any_powershell_downloadfile_filter", @@ -109384,9 +109384,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -109394,12 +109397,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "any_powershell_downloadstring_filter", @@ -109712,11 +109712,6 @@ "definition": "(Processes.process_name=bitsadmin.exe OR Processes.original_file_name=bitsadmin.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -109725,6 +109720,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "bitsadmin_download_file_filter", "definition": "search *", @@ -110022,6 +110022,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_certutil", "definition": "(Processes.process_name=certutil.exe OR Processes.original_file_name=CertUtil.exe)", @@ -110032,14 +110040,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "certutil_download_with_urlcache_and_split_arguments_filter", "definition": "search *", @@ -110338,6 +110338,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_certutil", "definition": "(Processes.process_name=certutil.exe OR Processes.original_file_name=CertUtil.exe)", @@ -110348,14 +110356,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "certutil_download_with_verifyctl_and_split_arguments_filter", "definition": "search *", @@ -110717,11 +110717,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -110730,6 +110725,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "curl_download_and_bash_execution_filter", "definition": "search *", @@ -111091,11 +111091,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -111104,6 +111099,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "wget_download_and_bash_execution_filter", "definition": "search *", @@ -111402,9 +111402,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_curl", @@ -111412,12 +111415,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "windows_curl_download_to_suspicious_path_filter", @@ -111715,9 +111715,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_curl", @@ -111725,12 +111728,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "windows_curl_upload_to_remote_destination_filter", @@ -111959,11 +111959,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -111972,6 +111967,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_curl_network_connection_filter", "definition": "search *", @@ -112186,11 +112186,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -112199,6 +112194,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_attackers_scanning_for_vulnerable_jboss_servers_filter", "definition": "search *", @@ -112361,11 +112361,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -112374,6 +112369,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_malicious_requests_to_exploit_jboss_servers_filter", "definition": "search *", @@ -114977,11 +114977,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -114990,6 +114985,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_add_files_in_known_crontab_directories_filter", "definition": "search *", @@ -115197,11 +115197,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -115210,6 +115205,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_add_user_account_filter", "definition": "search *", @@ -115413,11 +115413,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -115426,6 +115421,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_at_allow_config_file_creation_filter", "definition": "search *", @@ -115629,11 +115629,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -115642,6 +115637,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_at_application_execution_filter", "definition": "search *", @@ -115847,11 +115847,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -115860,6 +115855,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_change_file_owner_to_root_filter", "definition": "search *", @@ -116061,11 +116061,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -116074,6 +116069,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_common_process_for_elevation_control_filter", "definition": "search *", @@ -116274,11 +116274,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -116287,6 +116282,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_doas_conf_file_creation_filter", "definition": "search *", @@ -116489,11 +116489,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -116502,6 +116497,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_doas_tool_execution_filter", "definition": "search *", @@ -116704,11 +116704,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -116717,6 +116712,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_edit_cron_table_parameter_filter", "definition": "search *", @@ -116918,11 +116918,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -116931,6 +116926,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_file_created_in_kernel_driver_directory_filter", "definition": "search *", @@ -117132,11 +117132,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -117145,6 +117140,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_file_creation_in_init_boot_directory_filter", "definition": "search *", @@ -117345,11 +117345,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -117358,6 +117353,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_file_creation_in_profile_directory_filter", "definition": "search *", @@ -117560,11 +117560,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -117573,6 +117568,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_insert_kernel_module_using_insmod_utility_filter", "definition": "search *", @@ -117776,11 +117776,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -117789,6 +117784,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_install_kernel_module_using_modprobe_utility_filter", "definition": "search *", @@ -117991,11 +117991,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -118004,6 +117999,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_nopasswd_entry_in_sudoers_file_filter", "definition": "search *", @@ -118211,11 +118211,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -118224,6 +118219,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_possible_access_or_modification_of_sshd_config_file_filter", "definition": "search *", @@ -118436,11 +118436,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -118449,6 +118444,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_possible_access_to_credential_files_filter", "definition": "search *", @@ -118651,11 +118651,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -118664,6 +118659,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_possible_access_to_sudoers_file_filter", "definition": "search *", @@ -118866,11 +118866,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -118879,6 +118874,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_possible_append_command_to_at_allow_config_file_filter", "definition": "search *", @@ -119080,11 +119080,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -119093,6 +119088,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_possible_append_command_to_profile_config_file_filter", "definition": "search *", @@ -119296,11 +119296,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -119309,6 +119304,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter", "definition": "search *", @@ -119511,11 +119511,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -119524,6 +119519,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_possible_cronjob_modification_with_editor_filter", "definition": "search *", @@ -119729,11 +119729,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -119742,6 +119737,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_possible_ssh_key_file_creation_filter", "definition": "search *", @@ -119951,11 +119951,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -119964,6 +119959,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_preload_hijack_library_calls_filter", "definition": "search *", @@ -120167,11 +120167,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -120180,6 +120175,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_service_file_created_in_systemd_directory_filter", "definition": "search *", @@ -120382,11 +120382,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -120395,6 +120390,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_service_restarted_filter", "definition": "search *", @@ -120597,11 +120597,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -120610,6 +120605,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_service_started_or_enabled_filter", "definition": "search *", @@ -120811,11 +120811,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -120824,6 +120819,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_setuid_using_chmod_utility_filter", "definition": "search *", @@ -121025,11 +121025,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -121038,6 +121033,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_setuid_using_setcap_utility_filter", "definition": "search *", @@ -121236,11 +121236,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -121249,6 +121244,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_sudo_or_su_execution_filter", "definition": "search *", @@ -121448,11 +121448,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -121461,6 +121456,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_sudoers_tmp_file_creation_filter", "definition": "search *", @@ -121662,11 +121662,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -121675,6 +121670,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_visudo_utility_execution_filter", "definition": "search *", @@ -121946,11 +121946,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -121959,6 +121954,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_add_files_in_known_crontab_directories_filter", "definition": "search *", @@ -122166,11 +122166,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -122179,6 +122174,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_add_user_account_filter", "definition": "search *", @@ -122382,11 +122382,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -122395,6 +122390,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_at_allow_config_file_creation_filter", "definition": "search *", @@ -122598,11 +122598,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -122611,6 +122606,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_at_application_execution_filter", "definition": "search *", @@ -122816,11 +122816,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -122829,6 +122824,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_change_file_owner_to_root_filter", "definition": "search *", @@ -123030,11 +123030,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -123043,6 +123038,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_common_process_for_elevation_control_filter", "definition": "search *", @@ -123243,11 +123243,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -123256,6 +123251,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_doas_conf_file_creation_filter", "definition": "search *", @@ -123458,11 +123458,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -123471,6 +123466,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_doas_tool_execution_filter", "definition": "search *", @@ -123673,11 +123673,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -123686,6 +123681,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_edit_cron_table_parameter_filter", "definition": "search *", @@ -123887,11 +123887,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -123900,6 +123895,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_file_created_in_kernel_driver_directory_filter", "definition": "search *", @@ -124101,11 +124101,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -124114,6 +124109,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_file_creation_in_init_boot_directory_filter", "definition": "search *", @@ -124314,11 +124314,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -124327,6 +124322,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_file_creation_in_profile_directory_filter", "definition": "search *", @@ -124529,11 +124529,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -124542,6 +124537,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_insert_kernel_module_using_insmod_utility_filter", "definition": "search *", @@ -124745,11 +124745,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -124758,6 +124753,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_install_kernel_module_using_modprobe_utility_filter", "definition": "search *", @@ -124960,11 +124960,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -124973,6 +124968,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_nopasswd_entry_in_sudoers_file_filter", "definition": "search *", @@ -125219,11 +125219,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -125232,6 +125227,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_pkexec_privilege_escalation_filter", "definition": "search *", @@ -125439,11 +125439,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -125452,6 +125447,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_possible_access_or_modification_of_sshd_config_file_filter", "definition": "search *", @@ -125664,11 +125664,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -125677,6 +125672,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_possible_access_to_credential_files_filter", "definition": "search *", @@ -125879,11 +125879,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -125892,6 +125887,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_possible_access_to_sudoers_file_filter", "definition": "search *", @@ -126094,11 +126094,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -126107,6 +126102,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_possible_append_command_to_at_allow_config_file_filter", "definition": "search *", @@ -126308,11 +126308,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -126321,6 +126316,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_possible_append_command_to_profile_config_file_filter", "definition": "search *", @@ -126524,11 +126524,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -126537,6 +126532,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter", "definition": "search *", @@ -126739,11 +126739,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -126752,6 +126747,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_possible_cronjob_modification_with_editor_filter", "definition": "search *", @@ -126957,11 +126957,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -126970,6 +126965,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_possible_ssh_key_file_creation_filter", "definition": "search *", @@ -127179,11 +127179,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -127192,6 +127187,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_preload_hijack_library_calls_filter", "definition": "search *", @@ -127395,11 +127395,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -127408,6 +127403,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_service_file_created_in_systemd_directory_filter", "definition": "search *", @@ -127610,11 +127610,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -127623,6 +127618,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_service_restarted_filter", "definition": "search *", @@ -127825,11 +127825,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -127838,6 +127833,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_service_started_or_enabled_filter", "definition": "search *", @@ -128039,11 +128039,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -128052,6 +128047,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_setuid_using_chmod_utility_filter", "definition": "search *", @@ -128253,11 +128253,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -128266,6 +128261,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_setuid_using_setcap_utility_filter", "definition": "search *", @@ -128464,11 +128464,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -128477,6 +128472,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_sudo_or_su_execution_filter", "definition": "search *", @@ -128676,11 +128676,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -128689,6 +128684,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_sudoers_tmp_file_creation_filter", "definition": "search *", @@ -128890,11 +128890,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -128903,6 +128898,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_visudo_utility_execution_filter", "definition": "search *", @@ -129258,9 +129258,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -129268,12 +129271,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "any_powershell_downloadfile_filter", @@ -129530,6 +129530,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -129540,14 +129548,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "cmd_carry_out_string_command_parameter_filter", "definition": "search *", @@ -129909,11 +129909,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -129922,6 +129917,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "curl_download_and_bash_execution_filter", "definition": "search *", @@ -130765,11 +130765,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "linux_shells", "definition": "(Processes.process_name IN (\"sh\", \"ksh\", \"zsh\", \"bash\", \"dash\", \"rbash\", \"fish\", \"csh', \"tcsh', \"ion\", \"eshell\"))", @@ -130783,6 +130778,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "linux_java_spawning_shell_filter", "definition": "search *", @@ -131055,11 +131055,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -131068,6 +131063,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "outbound_network_connection_from_java_using_default_ports_filter", "definition": "search *", @@ -131380,9 +131380,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -131390,12 +131393,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "powershell___connect_to_internet_with_hidden_window_filter", @@ -131758,11 +131758,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -131771,6 +131766,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "wget_download_and_bash_execution_filter", "definition": "search *", @@ -131983,11 +131983,6 @@ "definition": "(Processes.process_name=cmd.exe OR Processes.process_name=powershell.exe)", "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -131996,6 +131991,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_java_spawning_shells_filter", "definition": "search *", @@ -132974,11 +132974,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -132987,6 +132982,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "log4shell_jndi_payload_injection_with_outbound_connection_filter", "definition": "search *", @@ -133278,11 +133278,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -133291,6 +133286,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "malicious_powershell_process___multiple_suspicious_command_line_arguments_filter", "definition": "search *", @@ -133595,9 +133595,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -133605,12 +133608,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "any_powershell_downloadfile_filter", @@ -133916,9 +133916,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -133926,12 +133929,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "any_powershell_downloadstring_filter", @@ -134688,9 +134688,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -134698,12 +134701,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "malicious_powershell_process___encoded_command_filter", @@ -134983,9 +134983,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -134993,12 +134996,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "malicious_powershell_process_with_obfuscation_techniques_filter", @@ -135281,11 +135281,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -135294,6 +135289,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "possible_lateral_movement_powershell_spawn_filter", "definition": "search *", @@ -135893,9 +135893,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -135903,12 +135906,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "powershell___connect_to_internet_with_hidden_window_filter", @@ -138930,11 +138930,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -138943,6 +138938,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter", "definition": "search *", @@ -139818,11 +139818,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -139831,6 +139826,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "execution_of_file_with_spaces_before_extension_filter", "definition": "search *", @@ -140070,11 +140070,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -140083,6 +140078,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_rundll32_rename_filter", "definition": "search *", @@ -140335,11 +140335,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -140348,6 +140343,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "execution_of_file_with_multiple_extensions_filter", "definition": "search *", @@ -140589,11 +140589,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "process_sdelete", "definition": "(Processes.process_name=sdelete.exe OR Processes.original_file_name=sdelete.exe)", @@ -140607,6 +140602,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "sdelete_application_execution_filter", "definition": "search *", @@ -140826,6 +140826,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_microsoftworkflowcompiler", "definition": "(Processes.process_name=microsoft.workflow.compiler.exe OR Processes.original_file_name=Microsoft.Workflow.Compiler.exe)", @@ -140836,14 +140844,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "suspicious_microsoft_workflow_compiler_rename_filter", "definition": "search *", @@ -141073,11 +141073,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "process_msbuild", "definition": "(Processes.process_name=msbuild.exe OR Processes.original_file_name=MSBuild.exe)", @@ -141091,6 +141086,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_msbuild_path_filter", "definition": "search *", @@ -141321,11 +141321,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "process_msbuild", "definition": "(Processes.process_name=msbuild.exe OR Processes.original_file_name=MSBuild.exe)", @@ -141339,6 +141334,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_msbuild_rename_filter", "definition": "search *", @@ -141581,11 +141581,6 @@ "definition": "lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true", "description": "This macro limits the output to process names that are in the Windows System directory" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -141594,6 +141589,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "system_processes_run_from_unexpected_locations_filter", "definition": "search *", @@ -141868,11 +141868,6 @@ "definition": "lookup update=true is_net_windows_file filename as process_name OUTPUT netFile | lookup update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile | search netFile=true", "description": "This macro limits the output to process names that are .net binaries on Windows Server 2016 and Windows 11." }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -141881,6 +141876,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_dotnet_binary_in_non_standard_path_filter", "definition": "search *", @@ -142155,11 +142155,6 @@ "definition": "(Processes.process_name=installutil.exe OR Processes.original_file_name=InstallUtil.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -142168,6 +142163,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_installutil_in_non_standard_path_filter", "definition": "search *", @@ -142385,11 +142385,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -142398,6 +142393,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "excessive_number_of_distinct_processes_created_in_windows_temp_folder_filter", "definition": "search *", @@ -142608,11 +142608,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -142621,6 +142616,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "excessive_number_of_taskhost_processes_filter", "definition": "search *", @@ -142900,11 +142900,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -142913,6 +142908,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "control_loading_from_world_writable_directory_filter", "definition": "search *", @@ -143763,11 +143763,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -143776,6 +143771,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "office_spawning_control_filter", "definition": "search *", @@ -144011,11 +144011,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -144024,6 +144019,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "rundll32_control_rundll_hunt_filter", "definition": "search *", @@ -144266,11 +144266,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -144279,6 +144274,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "rundll32_control_rundll_world_writable_directory_filter", "definition": "search *", @@ -144557,11 +144557,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -144570,6 +144565,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "no_windows_updates_in_a_time_frame_filter", "definition": "search *", @@ -144901,11 +144901,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -144914,6 +144909,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "processes_created_by_netsh_filter", "definition": "search *", @@ -145182,11 +145182,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "process_netsh", "definition": "(Processes.process_name=netsh.exe OR Processes.original_file_name=netsh.exe)", @@ -145200,6 +145195,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "processes_launching_netsh_filter", "definition": "search *", @@ -145744,11 +145744,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -145757,6 +145752,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "anomalous_usage_of_7zip_filter", "definition": "search *", @@ -146075,6 +146075,14 @@ "definition": "| inputlookup prohibited_apps_launching_cmd | rename prohibited_applications as parent_process_name | eval parent_process_name=\"*\" . parent_process_name | table parent_process_name", "description": "This macro outputs a list of process that should not be the parent process of cmd.exe" }, + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -146085,14 +146093,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "detect_prohibited_applications_spawning_cmd_exe_filter", "definition": "search *", @@ -146295,11 +146295,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -146308,6 +146303,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_rundll32_inline_hta_execution_filter", "definition": "search *", @@ -146580,9 +146580,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -146590,12 +146593,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "malicious_powershell_process___encoded_command_filter", @@ -146854,11 +146854,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -146867,6 +146862,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "sc_exe_manipulating_windows_services_filter", "definition": "search *", @@ -147099,11 +147099,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -147112,6 +147107,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "scheduled_task_deleted_or_created_via_cmd_filter", "definition": "search *", @@ -147363,11 +147363,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -147376,6 +147371,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "schtasks_scheduling_job_on_remote_system_filter", "definition": "search *", @@ -147597,11 +147597,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -147610,6 +147605,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_adfind_exe_filter", "definition": "search *", @@ -148291,11 +148291,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -148304,6 +148299,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_outbound_smb_traffic_filter", "definition": "search *", @@ -148517,11 +148517,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -148530,6 +148525,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "tor_traffic_filter", "definition": "search *", @@ -151700,11 +151700,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -151713,6 +151708,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "first_time_seen_command_line_argument_filter", "definition": "search *", @@ -151970,11 +151970,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -151983,6 +151978,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "sc_exe_manipulating_windows_services_filter", "definition": "search *", @@ -153320,11 +153320,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -153333,6 +153328,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "first_time_seen_command_line_argument_filter", "definition": "search *", @@ -153645,9 +153645,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -153655,12 +153658,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "powershell___connect_to_internet_with_hidden_window_filter", @@ -154114,11 +154114,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -154127,6 +154122,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "unusually_long_command_line_filter", "definition": "search *", @@ -154347,11 +154347,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -154360,6 +154355,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "unusually_long_command_line___mltk_filter", "definition": "search *", @@ -155290,11 +155290,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -155303,6 +155298,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "rundll32_with_no_command_line_arguments_with_network_filter", "definition": "search *", @@ -155532,11 +155532,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -155545,6 +155540,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "spoolsv_spawning_rundll32_filter", "definition": "search *", @@ -156696,11 +156696,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -156709,6 +156704,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_rundll32_no_command_line_arguments_filter", "definition": "search *", @@ -157623,11 +157623,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -157636,6 +157631,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "prohibited_network_traffic_allowed_filter", "definition": "search *", @@ -157807,11 +157807,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -157820,6 +157815,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "protocol_or_port_mismatch_filter", "definition": "search *", @@ -158033,11 +158033,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -158046,6 +158041,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "tor_traffic_filter", "definition": "search *", @@ -158282,11 +158282,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "dynamic_dns_providers", "definition": "lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True", @@ -158300,6 +158295,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_hosts_connecting_to_dynamic_domain_providers_filter", "definition": "search *", @@ -159108,28 +159108,28 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "process_powershell", "definition": "(Processes.process_name=pwsh.exe OR Processes.process_name=sqlps.exe OR Processes.process_name=sqltoolsps.exe OR Processes.process_name=powershell.exe OR Processes.process_name=powershell_ise.exe OR Processes.original_file_name=pwsh.dll OR Processes.original_file_name=PowerShell.EXE OR Processes.original_file_name=powershell_ise.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "w3wp_spawning_shell_filter", @@ -159296,11 +159296,6 @@ ] }, "macros": [ - { - "name": "exchange", - "definition": "sourcetype=\"MSWindows:IIS\"", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -159309,6 +159304,11 @@ "field" ] }, + { + "name": "exchange", + "definition": "sourcetype=\"MSWindows:IIS\"", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." + }, { "name": "exchange_powershell_abuse_via_ssrf_filter", "definition": "search *", @@ -160093,11 +160093,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -160106,6 +160101,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "scheduled_tasks_used_in_badrabbit_ransomware_filter", "definition": "search *", @@ -160324,11 +160324,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -160337,6 +160332,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "7zip_commandline_to_smb_share_path_filter", "definition": "search *", @@ -160517,11 +160517,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "process_netsh", "definition": "(Processes.process_name=netsh.exe OR Processes.original_file_name=netsh.exe)", @@ -160535,6 +160530,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "allow_file_and_printing_sharing_in_firewall_filter", "definition": "search *", @@ -160717,11 +160717,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "process_netsh", "definition": "(Processes.process_name=netsh.exe OR Processes.original_file_name=netsh.exe)", @@ -160735,6 +160730,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "allow_network_discovery_in_firewall_filter", "definition": "search *", @@ -161172,11 +161172,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -161185,6 +161180,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "bcdedit_failure_recovery_modification_filter", "definition": "search *", @@ -161456,11 +161456,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -161469,6 +161464,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "clear_unallocated_sector_using_cipher_app_filter", "definition": "search *", @@ -161931,11 +161931,6 @@ "definition": "lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Name | search Name !=False", "description": "This macro limits the output to files that have extensions associated with ransomware" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -161944,6 +161939,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "common_ransomware_extensions_filter", "definition": "search *", @@ -162176,11 +162176,6 @@ "definition": "lookup ransomware_notes_lookup ransomware_notes as file_name OUTPUT status as \"Known Ransomware Notes\" | search \"Known Ransomware Notes\"=True", "description": "This macro limits the output to files that have been identified as a ransomware note" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -162189,6 +162184,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "common_ransomware_notes_filter", "definition": "search *", @@ -162457,11 +162457,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -162470,6 +162465,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "conti_common_exec_parameter_filter", "definition": "search *", @@ -162936,11 +162936,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -162949,6 +162944,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "deleting_shadow_copies_filter", "definition": "search *", @@ -163187,6 +163187,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_rclone", "definition": "(Processes.original_file_name=rclone.exe OR Processes.process_name=rclone.exe)", @@ -163197,14 +163205,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "detect_rclone_command_line_usage_filter", "definition": "search *", @@ -163436,11 +163436,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -163449,6 +163444,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_renamed_rclone_filter", "definition": "search *", @@ -163675,11 +163675,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -163688,6 +163683,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_sharphound_command_line_arguments_filter", "definition": "search *", @@ -163931,11 +163931,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -163944,6 +163939,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_sharphound_file_modifications_filter", "definition": "search *", @@ -164174,11 +164174,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -164187,6 +164182,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_sharphound_usage_filter", "definition": "search *", @@ -164764,11 +164764,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -164777,6 +164772,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "disable_logs_using_wevtutil_filter", "definition": "search *", @@ -165191,11 +165191,6 @@ "definition": "(Processes.process_name=\"net.exe\" OR Processes.original_file_name=\"net.exe\" OR Processes.process_name=\"net1.exe\" OR Processes.original_file_name=\"net1.exe\")", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -165204,6 +165199,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "excessive_service_stop_attempt_filter", "definition": "search *", @@ -165421,11 +165421,6 @@ "definition": "(Processes.process_name=\"net.exe\" OR Processes.original_file_name=\"net.exe\" OR Processes.process_name=\"net1.exe\" OR Processes.original_file_name=\"net1.exe\")", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -165434,6 +165429,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "excessive_usage_of_net_app_filter", "definition": "search *", @@ -165909,11 +165909,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -165922,6 +165917,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "execute_javascript_with_jscript_com_clsid_filter", "definition": "search *", @@ -166094,11 +166094,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -166107,6 +166102,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "fsutil_zeroing_file_filter", "definition": "search *", @@ -166298,11 +166298,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -166311,6 +166306,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "icacls_grant_command_filter", "definition": "search *", @@ -166500,11 +166500,6 @@ ] }, "macros": [ - { - "name": "wineventlog_system", - "definition": "eventtype=wineventlog_system", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -166513,6 +166508,11 @@ "field" ] }, + { + "name": "wineventlog_system", + "definition": "eventtype=wineventlog_system", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." + }, { "name": "known_services_killed_by_ransomware_filter", "definition": "search *", @@ -166897,11 +166897,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -166910,6 +166905,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "msmpeng_application_dll_side_loading_filter", "definition": "search *", @@ -167100,11 +167100,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -167113,6 +167108,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "permission_modification_using_takeown_app_filter", "definition": "search *", @@ -167311,9 +167311,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -167321,12 +167324,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "powershell_disable_security_monitoring_filter", @@ -167974,11 +167974,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -167987,6 +167982,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "prevent_automatic_repair_mode_using_bcdedit_filter", "definition": "search *", @@ -168406,6 +168406,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -168416,14 +168424,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "recursive_delete_of_directory_in_batch_cmd_filter", "definition": "search *", @@ -168967,11 +168967,6 @@ "definition": "(Processes.process_name=wmic.exe OR Processes.original_file_name=wmic.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -168980,6 +168975,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "remote_process_instantiation_via_wmi_filter", "definition": "search *", @@ -169174,11 +169174,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -169187,6 +169182,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "revil_common_exec_parameter_filter", "definition": "search *", @@ -169652,11 +169652,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -169665,6 +169660,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "schtasks_used_for_forcing_a_reboot_filter", "definition": "search *", @@ -170368,11 +170368,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -170381,6 +170376,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_scheduled_task_from_public_directory_filter", "definition": "search *", @@ -170608,11 +170608,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -170621,6 +170616,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_wevtutil_usage_filter", "definition": "search *", @@ -170863,11 +170863,6 @@ "definition": "lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true", "description": "This macro limits the output to process names that are in the Windows System directory" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -170876,6 +170871,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "system_processes_run_from_unexpected_locations_filter", "definition": "search *", @@ -171304,11 +171304,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -171317,6 +171312,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "uninstall_app_using_msiexec_filter", "definition": "search *", @@ -171525,11 +171525,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -171538,6 +171533,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "usn_journal_deletion_filter", "definition": "search *", @@ -171730,11 +171730,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -171743,6 +171738,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "wbadmin_delete_system_backups_filter", "definition": "search *", @@ -172169,11 +172169,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -172182,6 +172177,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_diskcryptor_usage_filter", "definition": "search *", @@ -172456,11 +172456,6 @@ "definition": "lookup update=true is_net_windows_file filename as process_name OUTPUT netFile | lookup update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile | search netFile=true", "description": "This macro limits the output to process names that are .net binaries on Windows Server 2016 and Windows 11." }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -172469,6 +172464,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_dotnet_binary_in_non_standard_path_filter", "definition": "search *", @@ -172706,11 +172706,6 @@ "definition": "eventtype=wineventlog_security", "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." }, - { - "name": "wineventlog_system", - "definition": "eventtype=wineventlog_system", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -172719,6 +172714,11 @@ "field" ] }, + { + "name": "wineventlog_system", + "definition": "eventtype=wineventlog_system", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." + }, { "name": "windows_event_log_cleared_filter", "definition": "search *", @@ -172993,11 +172993,6 @@ "definition": "(Processes.process_name=installutil.exe OR Processes.original_file_name=InstallUtil.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -173006,6 +173001,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_installutil_in_non_standard_path_filter", "definition": "search *", @@ -173293,11 +173293,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -173306,6 +173301,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_nirsoft_advancedrun_filter", "definition": "search *", @@ -173554,11 +173554,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -173567,6 +173562,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_raccine_scheduled_task_deletion_filter", "definition": "search *", @@ -174625,11 +174625,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -174638,6 +174633,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "unusually_long_command_line_filter", "definition": "search *", @@ -174858,11 +174858,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -174871,6 +174866,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "unusually_long_command_line___mltk_filter", "definition": "search *", @@ -175095,11 +175095,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -175108,6 +175103,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "prohibited_network_traffic_allowed_filter", "definition": "search *", @@ -175750,11 +175750,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -175763,6 +175758,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "tor_traffic_filter", "definition": "search *", @@ -176783,11 +176783,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -176796,6 +176791,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "bcdedit_command_back_to_normal_mode_boot_filter", "definition": "search *", @@ -176983,11 +176983,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -176996,6 +176991,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "change_to_safe_mode_with_network_config_filter", "definition": "search *", @@ -177185,11 +177185,6 @@ ] }, "macros": [ - { - "name": "wineventlog_system", - "definition": "eventtype=wineventlog_system", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -177198,6 +177193,11 @@ "field" ] }, + { + "name": "wineventlog_system", + "definition": "eventtype=wineventlog_system", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." + }, { "name": "known_services_killed_by_ransomware_filter", "definition": "search *", @@ -177876,11 +177876,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -177889,6 +177884,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "clop_common_exec_parameter_filter", "definition": "search *", @@ -178116,11 +178116,6 @@ ] }, "macros": [ - { - "name": "wineventlog_system", - "definition": "eventtype=wineventlog_system", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -178129,6 +178124,11 @@ "field" ] }, + { + "name": "wineventlog_system", + "definition": "eventtype=wineventlog_system", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." + }, { "name": "clop_ransomware_known_service_name_filter", "definition": "search *", @@ -178361,11 +178361,6 @@ "definition": "lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Name | search Name !=False", "description": "This macro limits the output to files that have extensions associated with ransomware" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -178374,6 +178369,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "common_ransomware_extensions_filter", "definition": "search *", @@ -178606,11 +178606,6 @@ "definition": "lookup ransomware_notes_lookup ransomware_notes as file_name OUTPUT status as \"Known Ransomware Notes\" | search \"Known Ransomware Notes\"=True", "description": "This macro limits the output to files that have been identified as a ransomware note" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -178619,6 +178614,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "common_ransomware_notes_filter", "definition": "search *", @@ -178880,11 +178880,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -178893,6 +178888,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "deleting_shadow_copies_filter", "definition": "search *", @@ -179930,11 +179930,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -179943,6 +179938,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "resize_shadowstorage_volume_filter", "definition": "search *", @@ -180407,11 +180407,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -180420,6 +180415,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_wevtutil_usage_filter", "definition": "search *", @@ -180657,11 +180657,6 @@ "definition": "eventtype=wineventlog_security", "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." }, - { - "name": "wineventlog_system", - "definition": "eventtype=wineventlog_system", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -180670,6 +180665,11 @@ "field" ] }, + { + "name": "wineventlog_system", + "definition": "eventtype=wineventlog_system", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." + }, { "name": "windows_event_log_cleared_filter", "definition": "search *", @@ -180876,11 +180876,6 @@ ] }, "macros": [ - { - "name": "wineventlog_system", - "definition": "eventtype=wineventlog_system", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -180889,6 +180884,11 @@ "field" ] }, + { + "name": "wineventlog_system", + "definition": "eventtype=wineventlog_system", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." + }, { "name": "windows_service_created_with_suspicious_service_path_filter", "definition": "search *", @@ -181767,6 +181767,14 @@ "definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -181777,14 +181785,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "attempted_credential_dump_from_registry_via_reg_exe_filter", "definition": "search *", @@ -182096,11 +182096,6 @@ "definition": "(Processes.process_name=bitsadmin.exe OR Processes.original_file_name=bitsadmin.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -182109,6 +182104,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "bitsadmin_download_file_filter", "definition": "search *", @@ -182406,6 +182406,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_certutil", "definition": "(Processes.process_name=certutil.exe OR Processes.original_file_name=CertUtil.exe)", @@ -182416,14 +182424,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "certutil_download_with_urlcache_and_split_arguments_filter", "definition": "search *", @@ -182722,6 +182722,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_certutil", "definition": "(Processes.process_name=certutil.exe OR Processes.original_file_name=CertUtil.exe)", @@ -182732,14 +182740,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "certutil_download_with_verifyctl_and_split_arguments_filter", "definition": "search *", @@ -184027,11 +184027,6 @@ "definition": "(Processes.process_name=psexec.exe OR Processes.process_name=psexec64.exe OR Processes.original_file_name=psexec.c)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -184040,6 +184035,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_psexec_with_accepteula_flag_filter", "definition": "search *", @@ -184278,6 +184278,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_rclone", "definition": "(Processes.original_file_name=rclone.exe OR Processes.process_name=rclone.exe)", @@ -184288,14 +184296,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "detect_rclone_command_line_usage_filter", "definition": "search *", @@ -184550,11 +184550,6 @@ "definition": "(Processes.process_name=psexec.exe OR Processes.process_name=psexec64.exe OR Processes.original_file_name=psexec.c)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -184563,6 +184558,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_renamed_psexec_filter", "definition": "search *", @@ -184794,11 +184794,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -184807,6 +184802,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_renamed_rclone_filter", "definition": "search *", @@ -185053,11 +185053,6 @@ "definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -185066,6 +185061,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "extraction_of_registry_hives_filter", "definition": "search *", @@ -185484,11 +185484,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -185497,6 +185492,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "slui_runas_elevated_filter", "definition": "search *", @@ -185706,11 +185706,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -185719,6 +185714,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "slui_spawning_a_process_filter", "definition": "search *", @@ -186244,11 +186244,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "process_netsh", "definition": "(Processes.process_name=netsh.exe OR Processes.original_file_name=netsh.exe)", @@ -186262,6 +186257,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "allow_network_discovery_in_firewall_filter", "definition": "search *", @@ -187065,11 +187065,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -187078,6 +187073,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "msmpeng_application_dll_side_loading_filter", "definition": "search *", @@ -187276,9 +187276,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -187286,12 +187289,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "powershell_disable_security_monitoring_filter", @@ -187487,11 +187487,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -187500,6 +187495,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "revil_common_exec_parameter_filter", "definition": "search *", @@ -188178,11 +188178,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -188191,6 +188186,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_connhost_exe_started_forcefully_filter", "definition": "search *", @@ -188434,11 +188434,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -188447,6 +188442,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "bcdedit_failure_recovery_modification_filter", "definition": "search *", @@ -188679,11 +188679,6 @@ "definition": "lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Name | search Name !=False", "description": "This macro limits the output to files that have extensions associated with ransomware" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -188692,6 +188687,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "common_ransomware_extensions_filter", "definition": "search *", @@ -188924,11 +188924,6 @@ "definition": "lookup ransomware_notes_lookup ransomware_notes as file_name OUTPUT status as \"Known Ransomware Notes\" | search \"Known Ransomware Notes\"=True", "description": "This macro limits the output to files that have been identified as a ransomware note" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -188937,6 +188932,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "common_ransomware_notes_filter", "definition": "search *", @@ -189145,11 +189145,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -189158,6 +189153,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "nltest_domain_trust_discovery_filter", "definition": "search *", @@ -189365,11 +189365,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -189378,6 +189373,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "ryuk_test_files_detected_filter", "definition": "search *", @@ -189636,11 +189636,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -189649,6 +189644,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "ryuk_wake_on_lan_command_filter", "definition": "search *", @@ -189889,11 +189889,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -189902,6 +189897,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_scheduled_task_from_public_directory_filter", "definition": "search *", @@ -190094,11 +190094,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -190107,6 +190102,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "wbadmin_delete_system_backups_filter", "definition": "search *", @@ -190299,11 +190299,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -190312,6 +190307,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_disableantispyware_registry_filter", "definition": "search *", @@ -190538,11 +190538,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -190551,6 +190546,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_security_account_manager_stopped_filter", "definition": "search *", @@ -191777,11 +191777,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -191790,6 +191785,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "remote_desktop_network_traffic_filter", "definition": "search *", @@ -192155,11 +192155,6 @@ "definition": "lookup prohibited_softwares app as process_name OUTPUT is_prohibited | search is_prohibited=True", "description": "This macro limits the output to process_names that have been marked as prohibited" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -192168,6 +192163,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "prohibited_software_on_endpoint_filter", "definition": "search *", @@ -192487,11 +192487,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -192500,6 +192495,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "attacker_tools_on_endpoint_filter", "definition": "search *", @@ -193036,11 +193036,6 @@ "definition": "lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Name | search Name !=False", "description": "This macro limits the output to files that have extensions associated with ransomware" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -193049,6 +193044,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "common_ransomware_extensions_filter", "definition": "search *", @@ -193281,11 +193281,6 @@ "definition": "lookup ransomware_notes_lookup ransomware_notes as file_name OUTPUT status as \"Known Ransomware Notes\" | search \"Known Ransomware Notes\"=True", "description": "This macro limits the output to files that have been identified as a ransomware note" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -193294,6 +193289,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "common_ransomware_notes_filter", "definition": "search *", @@ -193555,11 +193555,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -193568,6 +193563,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "deleting_shadow_copies_filter", "definition": "search *", @@ -193853,11 +193853,6 @@ "definition": "(Processes.process_name=psexec.exe OR Processes.process_name=psexec64.exe OR Processes.original_file_name=psexec.c)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -193866,6 +193861,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_psexec_with_accepteula_flag_filter", "definition": "search *", @@ -194120,11 +194120,6 @@ "definition": "(Processes.process_name=psexec.exe OR Processes.process_name=psexec64.exe OR Processes.original_file_name=psexec.c)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -194133,6 +194128,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_renamed_psexec_filter", "definition": "search *", @@ -194343,11 +194343,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -194356,6 +194351,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "file_with_samsam_extension_filter", "definition": "search *", @@ -194566,11 +194566,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -194579,6 +194574,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "samsam_test_file_write_filter", "definition": "search *", @@ -195292,11 +195292,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -195305,6 +195300,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "remote_desktop_network_traffic_filter", "definition": "search *", @@ -195481,11 +195481,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -195494,6 +195489,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_attackers_scanning_for_vulnerable_jboss_servers_filter", "definition": "search *", @@ -195656,11 +195656,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -195669,6 +195664,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_malicious_requests_to_exploit_jboss_servers_filter", "definition": "search *", @@ -196346,11 +196346,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -196359,6 +196354,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "add_or_set_windows_defender_exclusion_filter", "definition": "search *", @@ -196814,11 +196814,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -196827,6 +196822,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "executables_or_script_creation_in_suspicious_path_filter", "definition": "search *", @@ -197051,11 +197051,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -197064,6 +197059,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "jscript_execution_using_cscript_app_filter", "definition": "search *", @@ -197498,11 +197498,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -197511,6 +197506,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "malicious_inprocserver32_modification_filter", "definition": "search *", @@ -198173,11 +198173,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -198186,6 +198181,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "possible_browser_pass_view_parameter_filter", "definition": "search *", @@ -198850,11 +198850,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -198863,6 +198858,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "process_writing_dynamicwrapperx_filter", "definition": "search *", @@ -199389,6 +199389,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_regsvr32", "definition": "(Processes.process_name=regsvr32.exe OR Processes.original_file_name=REGSVR32.EXE)", @@ -199399,14 +199407,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "regsvr32_silent_and_install_param_dll_loading_filter", "definition": "search *", @@ -199652,6 +199652,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_regsvr32", "definition": "(Processes.process_name=regsvr32.exe OR Processes.original_file_name=REGSVR32.EXE)", @@ -199662,14 +199670,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "regsvr32_with_known_silent_switch_cmdline_filter", "definition": "search *", @@ -200043,11 +200043,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -200056,6 +200051,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "remcos_rat_file_creation_in_remcos_folder_filter", "definition": "search *", @@ -200718,11 +200718,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -200731,6 +200726,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_process_file_path_filter", "definition": "search *", @@ -201132,11 +201132,6 @@ "definition": "(Processes.process_name=dxdiag.exe OR Processes.original_file_name=dxdiag.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -201145,6 +201140,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "system_info_gathering_using_dxdiag_application_filter", "definition": "search *", @@ -201393,11 +201393,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -201406,6 +201401,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "vbscript_execution_using_wscript_app_filter", "definition": "search *", @@ -201869,11 +201869,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -201882,6 +201877,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "winhlp32_spawning_a_process_filter", "definition": "search *", @@ -202111,11 +202111,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -202124,6 +202119,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "wscript_or_cscript_suspicious_child_process_filter", "definition": "search *", @@ -202330,11 +202330,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -202343,6 +202338,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_new_login_attempts_to_routers_filter", "definition": "search *", @@ -203318,11 +203318,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -203331,6 +203326,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_software_download_to_network_device_filter", "definition": "search *", @@ -203940,11 +203940,6 @@ "definition": "lookup update=true is_net_windows_file filename as process_name OUTPUT netFile | lookup update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile | search netFile=true", "description": "This macro limits the output to process names that are .net binaries on Windows Server 2016 and Windows 11." }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -203953,6 +203948,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_dotnet_binary_in_non_standard_path_filter", "definition": "search *", @@ -204477,11 +204477,6 @@ "definition": "(Processes.process_name=installutil.exe OR Processes.original_file_name=InstallUtil.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -204490,6 +204485,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_installutil_in_non_standard_path_filter", "definition": "search *", @@ -204735,11 +204735,6 @@ "definition": "(Processes.process_name=installutil.exe OR Processes.original_file_name=InstallUtil.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -204748,6 +204743,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_installutil_remote_network_connection_filter", "definition": "search *", @@ -204992,11 +204992,6 @@ "definition": "(Processes.process_name=installutil.exe OR Processes.original_file_name=InstallUtil.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -205005,6 +205000,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_installutil_uninstall_option_filter", "definition": "search *", @@ -205252,11 +205252,6 @@ "definition": "(Processes.process_name=installutil.exe OR Processes.original_file_name=InstallUtil.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -205265,6 +205260,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_installutil_uninstall_option_with_network_filter", "definition": "search *", @@ -205508,11 +205508,6 @@ "definition": "(Processes.process_name=installutil.exe OR Processes.original_file_name=InstallUtil.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -205521,6 +205516,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_installutil_url_in_command_line_filter", "definition": "search *", @@ -205787,11 +205787,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -205800,6 +205795,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_curl_network_connection_filter", "definition": "search *", @@ -205966,11 +205966,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -205979,6 +205974,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_plistbuddy_usage_filter", "definition": "search *", @@ -206286,11 +206286,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -206299,6 +206294,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_sqlite3_lsquarantine_behavior_filter", "definition": "search *", @@ -206606,9 +206606,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -206616,12 +206619,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "excel_spawning_powershell_filter", @@ -206871,11 +206871,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -206884,6 +206879,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "excel_spawning_windows_script_host_filter", "definition": "search *", @@ -207432,11 +207432,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -207445,6 +207440,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "office_application_spawn_rundll32_process_filter", "definition": "search *", @@ -208208,11 +208208,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -208221,6 +208216,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "office_document_spawned_child_process_to_download_filter", "definition": "search *", @@ -208490,11 +208490,6 @@ "definition": "(Processes.process_name=bitsadmin.exe OR Processes.original_file_name=bitsadmin.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -208503,6 +208498,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "office_product_spawning_bitsadmin_filter", "definition": "search *", @@ -208768,6 +208768,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_certutil", "definition": "(Processes.process_name=certutil.exe OR Processes.original_file_name=CertUtil.exe)", @@ -208778,14 +208786,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "office_product_spawning_certutil_filter", "definition": "search *", @@ -209052,6 +209052,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_mshta", "definition": "(Processes.process_name=mshta.exe OR Processes.original_file_name=MSHTA.EXE)", @@ -209062,14 +209070,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "office_product_spawning_mshta_filter", "definition": "search *", @@ -209341,11 +209341,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -209354,6 +209349,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "office_product_spawning_rundll32_with_no_dll_filter", "definition": "search *", @@ -209627,11 +209627,6 @@ "definition": "(Processes.process_name=wmic.exe OR Processes.original_file_name=wmic.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -209640,6 +209635,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "office_product_spawning_wmic_filter", "definition": "search *", @@ -210197,11 +210197,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -210210,6 +210205,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "office_spawning_control_filter", "definition": "search *", @@ -210469,11 +210469,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -210482,6 +210477,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "process_creating_lnk_file_in_suspicious_location_filter", "definition": "search *", @@ -210765,6 +210765,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -210775,14 +210783,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "winword_spawning_cmd_filter", "definition": "search *", @@ -211070,9 +211070,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -211080,12 +211083,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "winword_spawning_powershell_filter", @@ -211623,11 +211623,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -211636,6 +211631,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_outlook_exe_writing_a_zip_file_filter", "definition": "search *", @@ -218283,11 +218283,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -218296,6 +218291,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "cloud_instance_modified_by_previously_unseen_user_filter", "definition": "search *", @@ -219601,11 +219601,6 @@ ] }, "macros": [ - { - "name": "previously_unseen_cloud_provisioning_activity_window", - "definition": "\"-70m@m\"", - "description": "Use this macro to determine how far back you should be checking for new provisioning activities" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -219614,6 +219609,11 @@ "field" ] }, + { + "name": "previously_unseen_cloud_provisioning_activity_window", + "definition": "\"-70m@m\"", + "description": "Use this macro to determine how far back you should be checking for new provisioning activities" + }, { "name": "cloud_provisioning_activity_from_previously_unseen_city_filter", "definition": "search *", @@ -220406,11 +220406,6 @@ ] }, "macros": [ - { - "name": "previously_unseen_cloud_provisioning_activity_window", - "definition": "\"-70m@m\"", - "description": "Use this macro to determine how far back you should be checking for new provisioning activities" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -220419,6 +220414,11 @@ "field" ] }, + { + "name": "previously_unseen_cloud_provisioning_activity_window", + "definition": "\"-70m@m\"", + "description": "Use this macro to determine how far back you should be checking for new provisioning activities" + }, { "name": "cloud_provisioning_activity_from_previously_unseen_ip_address_filter", "definition": "search *", @@ -220811,11 +220811,6 @@ ] }, "macros": [ - { - "name": "previously_unseen_cloud_provisioning_activity_window", - "definition": "\"-70m@m\"", - "description": "Use this macro to determine how far back you should be checking for new provisioning activities" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -220824,6 +220819,11 @@ "field" ] }, + { + "name": "previously_unseen_cloud_provisioning_activity_window", + "definition": "\"-70m@m\"", + "description": "Use this macro to determine how far back you should be checking for new provisioning activities" + }, { "name": "cloud_provisioning_activity_from_previously_unseen_region_filter", "definition": "search *", @@ -222530,11 +222530,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -222543,6 +222538,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "first_time_seen_command_line_argument_filter", "definition": "search *", @@ -222861,6 +222861,14 @@ "definition": "| inputlookup prohibited_apps_launching_cmd | rename prohibited_applications as parent_process_name | eval parent_process_name=\"*\" . parent_process_name | table parent_process_name", "description": "This macro outputs a list of process that should not be the parent process of cmd.exe" }, + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -222871,14 +222879,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "detect_prohibited_applications_spawning_cmd_exe_filter", "definition": "search *", @@ -223139,11 +223139,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -223152,6 +223147,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_use_of_cmd_exe_to_launch_script_interpreters_filter", "definition": "search *", @@ -223398,11 +223398,6 @@ "definition": "eval orig_process=process, process=replace(lower(process), \"`\", \"\") | makemv tokenizer=\"([\\w\\d\\-]+)\" process | eval unusual_cmdline_feature_for=if(match(process, \"^for$\"), mvcount(mvfilter(match(process, \"^for$\"))), 0), unusual_cmdline_feature_netsh=if(match(process, \"^netsh$\"), mvcount(mvfilter(match(process, \"^netsh$\"))), 0), unusual_cmdline_feature_readbytes=if(match(process, \"^readbytes$\"), mvcount(mvfilter(match(process, \"^readbytes$\"))), 0), unusual_cmdline_feature_set=if(match(process, \"^set$\"), mvcount(mvfilter(match(process, \"^set$\"))), 0), unusual_cmdline_feature_unrestricted=if(match(process, \"^unrestricted$\"), mvcount(mvfilter(match(process, \"^unrestricted$\"))), 0), unusual_cmdline_feature_winstations=if(match(process, \"^winstations$\"), mvcount(mvfilter(match(process, \"^winstations$\"))), 0), unusual_cmdline_feature_-value=if(match(process, \"^-value$\"), mvcount(mvfilter(match(process, \"^-value$\"))), 0), unusual_cmdline_feature_compression=if(match(process, \"^compression$\"), mvcount(mvfilter(match(process, \"^compression$\"))), 0), unusual_cmdline_feature_server=if(match(process, \"^server$\"), mvcount(mvfilter(match(process, \"^server$\"))), 0), unusual_cmdline_feature_set-mppreference=if(match(process, \"^set-mppreference$\"), mvcount(mvfilter(match(process, \"^set-mppreference$\"))), 0), unusual_cmdline_feature_terminal=if(match(process, \"^terminal$\"), mvcount(mvfilter(match(process, \"^terminal$\"))), 0), unusual_cmdline_feature_-name=if(match(process, \"^-name$\"), mvcount(mvfilter(match(process, \"^-name$\"))), 0), unusual_cmdline_feature_catch=if(match(process, \"^catch$\"), mvcount(mvfilter(match(process, \"^catch$\"))), 0), unusual_cmdline_feature_get-wmiobject=if(match(process, \"^get-wmiobject$\"), mvcount(mvfilter(match(process, \"^get-wmiobject$\"))), 0), unusual_cmdline_feature_hklm=if(match(process, \"^hklm$\"), mvcount(mvfilter(match(process, \"^hklm$\"))), 0), unusual_cmdline_feature_streamreader=if(match(process, \"^streamreader$\"), mvcount(mvfilter(match(process, \"^streamreader$\"))), 0), unusual_cmdline_feature_system32=if(match(process, \"^system32$\"), mvcount(mvfilter(match(process, \"^system32$\"))), 0), unusual_cmdline_feature_username=if(match(process, \"^username$\"), mvcount(mvfilter(match(process, \"^username$\"))), 0), unusual_cmdline_feature_webrequest=if(match(process, \"^webrequest$\"), mvcount(mvfilter(match(process, \"^webrequest$\"))), 0), unusual_cmdline_feature_count=if(match(process, \"^count$\"), mvcount(mvfilter(match(process, \"^count$\"))), 0), unusual_cmdline_feature_webclient=if(match(process, \"^webclient$\"), mvcount(mvfilter(match(process, \"^webclient$\"))), 0), unusual_cmdline_feature_writeallbytes=if(match(process, \"^writeallbytes$\"), mvcount(mvfilter(match(process, \"^writeallbytes$\"))), 0), unusual_cmdline_feature_convert=if(match(process, \"^convert$\"), mvcount(mvfilter(match(process, \"^convert$\"))), 0), unusual_cmdline_feature_create=if(match(process, \"^create$\"), mvcount(mvfilter(match(process, \"^create$\"))), 0), unusual_cmdline_feature_function=if(match(process, \"^function$\"), mvcount(mvfilter(match(process, \"^function$\"))), 0), unusual_cmdline_feature_net=if(match(process, \"^net$\"), mvcount(mvfilter(match(process, \"^net$\"))), 0), unusual_cmdline_feature_com=if(match(process, \"^com$\"), mvcount(mvfilter(match(process, \"^com$\"))), 0), unusual_cmdline_feature_http=if(match(process, \"^http$\"), mvcount(mvfilter(match(process, \"^http$\"))), 0), unusual_cmdline_feature_io=if(match(process, \"^io$\"), mvcount(mvfilter(match(process, \"^io$\"))), 0), unusual_cmdline_feature_system=if(match(process, \"^system$\"), mvcount(mvfilter(match(process, \"^system$\"))), 0), unusual_cmdline_feature_new-object=if(match(process, \"^new-object$\"), mvcount(mvfilter(match(process, \"^new-object$\"))), 0), unusual_cmdline_feature_if=if(match(process, \"^if$\"), mvcount(mvfilter(match(process, \"^if$\"))), 0), unusual_cmdline_feature_threading=if(match(process, \"^threading$\"), mvcount(mvfilter(match(process, \"^threading$\"))), 0), unusual_cmdline_feature_mutex=if(match(process, \"^mutex$\"), mvcount(mvfilter(match(process, \"^mutex$\"))), 0), unusual_cmdline_feature_cryptography=if(match(process, \"^cryptography$\"), mvcount(mvfilter(match(process, \"^cryptography$\"))), 0), unusual_cmdline_feature_computehash=if(match(process, \"^computehash$\"), mvcount(mvfilter(match(process, \"^computehash$\"))), 0)", "description": "Performs the tokenization and application of the malicious commandline classifier" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -223411,6 +223406,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "potentially_malicious_code_on_commandline_filter", "definition": "search *", @@ -223653,11 +223653,6 @@ "definition": "lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true", "description": "This macro limits the output to process names that are in the Windows System directory" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -223666,6 +223661,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "system_processes_run_from_unexpected_locations_filter", "definition": "search *", @@ -223835,11 +223835,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -223848,6 +223843,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "unusually_long_command_line_filter", "definition": "search *", @@ -224068,11 +224068,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -224081,6 +224076,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "unusually_long_command_line___mltk_filter", "definition": "search *", @@ -224611,11 +224611,6 @@ "definition": "(Processes.process_name=hh.exe OR Processes.original_file_name=HH.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -224624,6 +224619,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_html_help_renamed_filter", "definition": "search *", @@ -224889,11 +224889,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -224902,6 +224897,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_html_help_spawn_child_process_filter", "definition": "search *", @@ -225173,11 +225173,6 @@ "definition": "(Processes.process_name=hh.exe OR Processes.original_file_name=HH.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -225186,6 +225181,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_html_help_url_in_command_line_filter", "definition": "search *", @@ -225419,11 +225419,6 @@ "definition": "(Processes.process_name=hh.exe OR Processes.original_file_name=HH.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -225432,6 +225427,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_html_help_using_infotech_storage_handlers_filter", "definition": "search *", @@ -225861,11 +225861,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -225874,6 +225869,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_long_dns_txt_record_response_filter", "definition": "search *", @@ -226494,11 +226494,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -226507,6 +226502,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "dns_exfiltration_using_nslookup_app_filter", "definition": "search *", @@ -226931,11 +226931,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -226944,6 +226939,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "dns_query_length_outliers___mltk_filter", "definition": "search *", @@ -227365,11 +227365,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "dynamic_dns_providers", "definition": "lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True", @@ -227383,6 +227378,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_hosts_connecting_to_dynamic_domain_providers_filter", "definition": "search *", @@ -228149,11 +228149,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -228162,6 +228157,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_email___uba_anomaly_filter", "definition": "search *", @@ -228299,11 +228299,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -228312,6 +228307,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "email_attachments_with_lots_of_spaces_filter", "definition": "search *", @@ -228505,11 +228505,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -228518,6 +228513,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "monitor_email_for_brand_abuse_filter", "definition": "search *", @@ -228754,11 +228754,6 @@ "definition": "lookup update=true is_suspicious_file_extension_lookup file_name OUTPUT suspicious | search suspicious=true", "description": "This macro limits the output to email attachments that have suspicious extensions" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -228767,6 +228762,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_email_attachment_extensions_filter", "definition": "search *", @@ -229701,6 +229701,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_mshta", "definition": "(Processes.process_name=mshta.exe OR Processes.original_file_name=MSHTA.EXE)", @@ -229711,14 +229719,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "detect_mshta_inline_hta_execution_filter", "definition": "search *", @@ -229957,6 +229957,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_mshta", "definition": "(Processes.process_name=mshta.exe OR Processes.original_file_name=MSHTA.EXE)", @@ -229967,14 +229975,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "detect_mshta_renamed_filter", "definition": "search *", @@ -230221,6 +230221,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_mshta", "definition": "(Processes.process_name=mshta.exe OR Processes.original_file_name=MSHTA.EXE)", @@ -230231,14 +230239,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "detect_mshta_url_in_command_line_filter", "definition": "search *", @@ -230557,6 +230557,14 @@ "definition": "| inputlookup prohibited_apps_launching_cmd | rename prohibited_applications as parent_process_name | eval parent_process_name=\"*\" . parent_process_name | table parent_process_name", "description": "This macro outputs a list of process that should not be the parent process of cmd.exe" }, + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -230567,14 +230575,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "detect_prohibited_applications_spawning_cmd_exe_filter", "definition": "search *", @@ -230777,11 +230777,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -230790,6 +230785,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_rundll32_inline_hta_execution_filter", "definition": "search *", @@ -231295,11 +231295,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -231308,6 +231303,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_mshta_child_process_filter", "definition": "search *", @@ -231501,6 +231501,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_mshta", "definition": "(Processes.process_name=mshta.exe OR Processes.original_file_name=MSHTA.EXE)", @@ -231511,14 +231519,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "suspicious_mshta_spawn_filter", "definition": "search *", @@ -231985,11 +231985,6 @@ ] }, "macros": [ - { - "name": "okta", - "definition": "eventtype=okta_log", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -231998,6 +231993,11 @@ "field" ] }, + { + "name": "okta", + "definition": "eventtype=okta_log", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." + }, { "name": "multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter", "definition": "search *", @@ -232376,11 +232376,6 @@ ] }, "macros": [ - { - "name": "okta", - "definition": "eventtype=okta_log", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -232389,6 +232384,11 @@ "field" ] }, + { + "name": "okta", + "definition": "eventtype=okta_log", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." + }, { "name": "okta_failed_sso_attempts_filter", "definition": "search *", @@ -232575,11 +232575,6 @@ ] }, "macros": [ - { - "name": "okta", - "definition": "eventtype=okta_log", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -232588,6 +232583,11 @@ "field" ] }, + { + "name": "okta", + "definition": "eventtype=okta_log", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." + }, { "name": "okta_user_logins_from_multiple_cities_filter", "definition": "search *", @@ -232999,11 +232999,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -233012,6 +233007,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_regasm_spawning_a_process_filter", "definition": "search *", @@ -233496,11 +233496,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "process_regasm", "definition": "(Processes.process_name=regasm.exe OR Processes.original_file_name=RegAsm.exe)", @@ -233514,6 +233509,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_regasm_with_no_command_line_arguments_filter", "definition": "search *", @@ -233748,11 +233748,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -233761,6 +233756,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_regsvcs_spawning_a_process_filter", "definition": "search *", @@ -234224,6 +234224,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_regsvcs", "definition": "(Processes.process_name=regsvcs.exe OR Processes.original_file_name=RegSvcs.exe)", @@ -234234,14 +234242,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "detect_regsvcs_with_no_command_line_arguments_filter", "definition": "search *", @@ -234533,6 +234533,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_regsvr32", "definition": "(Processes.process_name=regsvr32.exe OR Processes.original_file_name=REGSVR32.EXE)", @@ -234543,14 +234551,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "detect_regsvr32_application_control_bypass_filter", "definition": "search *", @@ -234771,11 +234771,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -234784,6 +234779,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "malicious_inprocserver32_modification_filter", "definition": "search *", @@ -235027,6 +235027,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_regsvr32", "definition": "(Processes.process_name=regsvr32.exe OR Processes.original_file_name=REGSVR32.EXE)", @@ -235037,14 +235045,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "regsvr32_silent_and_install_param_dll_loading_filter", "definition": "search *", @@ -235290,6 +235290,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_regsvr32", "definition": "(Processes.process_name=regsvr32.exe OR Processes.original_file_name=REGSVR32.EXE)", @@ -235300,14 +235308,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "regsvr32_with_known_silent_switch_cmdline_filter", "definition": "search *", @@ -235524,6 +235524,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_regsvr32", "definition": "(Processes.process_name=regsvr32.exe OR Processes.original_file_name=REGSVR32.EXE)", @@ -235534,14 +235542,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "suspicious_regsvr32_register_suspicious_path_filter", "definition": "search *", @@ -235828,11 +235828,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -235841,6 +235836,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_rundll32_rename_filter", "definition": "search *", @@ -236102,11 +236102,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -236115,6 +236110,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_rundll32_application_control_bypass___advpack_filter", "definition": "search *", @@ -236396,11 +236396,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -236409,6 +236404,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_rundll32_application_control_bypass___setupapi_filter", "definition": "search *", @@ -236690,11 +236690,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -236703,6 +236698,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_rundll32_application_control_bypass___syssetup_filter", "definition": "search *", @@ -237008,11 +237008,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -237021,6 +237016,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "dump_lsass_via_comsvcs_dll_filter", "definition": "search *", @@ -237256,11 +237256,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -237269,6 +237264,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "rundll32_control_rundll_hunt_filter", "definition": "search *", @@ -237511,11 +237511,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -237524,6 +237519,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "rundll32_control_rundll_world_writable_directory_filter", "definition": "search *", @@ -237750,11 +237750,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -237763,6 +237758,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "rundll32_with_no_command_line_arguments_with_network_filter", "definition": "search *", @@ -238011,11 +238011,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -238024,6 +238019,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_rundll32_dllregisterserver_filter", "definition": "search *", @@ -238257,11 +238257,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -238270,6 +238265,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_rundll32_startw_filter", "definition": "search *", @@ -238502,11 +238502,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -238515,6 +238510,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_rundll32_no_command_line_arguments_filter", "definition": "search *", @@ -238729,11 +238729,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -238742,6 +238737,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "reg_exe_used_to_hide_files_directories_via_registry_keys_filter", "definition": "search *", @@ -238885,11 +238885,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -238898,6 +238893,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "remote_registry_key_modifications_filter", "definition": "search *", @@ -239064,11 +239064,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -239077,6 +239072,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_changes_to_file_associations_filter", "definition": "search *", @@ -241148,11 +241148,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -241161,6 +241156,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "process_execution_via_wmi_filter", "definition": "search *", @@ -241421,11 +241421,6 @@ "definition": "(Processes.process_name=wmic.exe OR Processes.original_file_name=wmic.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -241434,6 +241429,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "remote_process_instantiation_via_wmi_filter", "definition": "search *", @@ -241685,11 +241685,6 @@ "definition": "(Processes.process_name=wmic.exe OR Processes.original_file_name=wmic.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -241698,6 +241693,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "remote_wmi_command_attempt_filter", "definition": "search *", @@ -241940,11 +241940,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -241953,6 +241948,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "script_execution_via_wmi_filter", "definition": "search *", @@ -242435,11 +242435,6 @@ "definition": "(Processes.process_name=wmic.exe OR Processes.original_file_name=wmic.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -242448,6 +242443,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "wmic_xsl_execution_via_url_filter", "definition": "search *", @@ -242687,11 +242687,6 @@ "definition": "(Processes.process_name=wmic.exe OR Processes.original_file_name=wmic.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -242700,6 +242695,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "xsl_script_execution_with_wmic_filter", "definition": "search *", @@ -243733,6 +243733,14 @@ "definition": "| inputlookup prohibited_apps_launching_cmd | rename prohibited_applications as parent_process_name | eval parent_process_name=\"*\" . parent_process_name | table parent_process_name", "description": "This macro outputs a list of process that should not be the parent process of cmd.exe" }, + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -243743,14 +243751,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "detect_prohibited_applications_spawning_cmd_exe_filter", "definition": "search *", @@ -244086,11 +244086,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -244104,6 +244099,11 @@ "definition": "\"-70m@m\"", "description": "Use this macro to determine how far back you should be checking for new zoom child processes" }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "first_time_seen_child_process_of_zoom_filter", "definition": "search *", @@ -244435,11 +244435,6 @@ "definition": "(Processes.process_name=\"net.exe\" OR Processes.original_file_name=\"net.exe\" OR Processes.process_name=\"net1.exe\" OR Processes.original_file_name=\"net1.exe\")", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -244448,6 +244443,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "account_discovery_with_net_app_filter", "definition": "search *", @@ -244741,11 +244741,6 @@ "definition": "(Processes.process_name=\"net.exe\" OR Processes.original_file_name=\"net.exe\" OR Processes.process_name=\"net1.exe\" OR Processes.original_file_name=\"net1.exe\")", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -244754,6 +244749,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "attempt_to_stop_security_service_filter", "definition": "search *", @@ -245472,6 +245472,14 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_regsvr32", "definition": "(Processes.process_name=regsvr32.exe OR Processes.original_file_name=REGSVR32.EXE)", @@ -245482,14 +245490,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "mshta_spawning_rundll32_or_regsvr32_process_filter", "definition": "search *", @@ -245745,11 +245745,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -245758,6 +245753,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "office_application_spawn_rundll32_process_filter", "definition": "search *", @@ -246225,6 +246225,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -246235,14 +246243,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "office_product_spawn_cmd_process_filter", "definition": "search *", @@ -246885,11 +246885,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -246898,6 +246893,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_rundll32_startw_filter", "definition": "search *", @@ -247749,28 +247749,28 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "process_powershell", "definition": "(Processes.process_name=pwsh.exe OR Processes.process_name=sqlps.exe OR Processes.process_name=sqltoolsps.exe OR Processes.process_name=powershell.exe OR Processes.process_name=powershell_ise.exe OR Processes.original_file_name=pwsh.dll OR Processes.original_file_name=PowerShell.EXE OR Processes.original_file_name=powershell_ise.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "wermgr_process_spawned_cmd_or_powershell_process_filter", @@ -248029,6 +248029,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_microsoftworkflowcompiler", "definition": "(Processes.process_name=microsoft.workflow.compiler.exe OR Processes.original_file_name=Microsoft.Workflow.Compiler.exe)", @@ -248039,14 +248047,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "suspicious_microsoft_workflow_compiler_rename_filter", "definition": "search *", @@ -248243,6 +248243,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_microsoftworkflowcompiler", "definition": "(Processes.process_name=microsoft.workflow.compiler.exe OR Processes.original_file_name=Microsoft.Workflow.Compiler.exe)", @@ -248253,14 +248261,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "suspicious_microsoft_workflow_compiler_usage_filter", "definition": "search *", @@ -248499,11 +248499,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "process_msbuild", "definition": "(Processes.process_name=msbuild.exe OR Processes.original_file_name=MSBuild.exe)", @@ -248517,6 +248512,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "msbuild_suspicious_spawned_by_script_process_filter", "definition": "search *", @@ -248746,11 +248746,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "process_msbuild", "definition": "(Processes.process_name=msbuild.exe OR Processes.original_file_name=MSBuild.exe)", @@ -248764,6 +248759,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_msbuild_path_filter", "definition": "search *", @@ -248994,11 +248994,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "process_msbuild", "definition": "(Processes.process_name=msbuild.exe OR Processes.original_file_name=MSBuild.exe)", @@ -249012,6 +249007,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_msbuild_rename_filter", "definition": "search *", @@ -249216,11 +249216,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "process_msbuild", "definition": "(Processes.process_name=msbuild.exe OR Processes.original_file_name=MSBuild.exe)", @@ -249234,6 +249229,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_msbuild_spawn_filter", "definition": "search *", @@ -249511,11 +249511,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -249524,6 +249519,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "rundll_loading_dll_by_ordinal_filter", "definition": "search *", @@ -249749,11 +249749,6 @@ "definition": "lookup update=true lookup_uncommon_processes_default process_name as process_name outputnew uncommon_default,category_default,analytic_story_default,kill_chain_phase_default,mitre_attack_default | lookup update=true lookup_uncommon_processes_local process_name as process_name outputnew uncommon_local,category_local,analytic_story_local,kill_chain_phase_local,mitre_attack_local | eval uncommon = coalesce(uncommon_default, uncommon_local), analytic_story = coalesce(analytic_story_default, analytic_story_local), category=coalesce(category_default, category_local), kill_chain_phase=coalesce(kill_chain_phase_default, kill_chain_phase_local), mitre_attack=coalesce(mitre_attack_default, mitre_attack_local) | fields - analytic_story_default, analytic_story_local, category_default, category_local, kill_chain_phase_default, kill_chain_phase_local, mitre_attack_default, mitre_attack_local, uncommon_default, uncommon_local | search uncommon=true", "description": "This macro limits the output to processes that have been marked as uncommon" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -249762,6 +249757,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "uncommon_processes_on_endpoint_filter", "definition": "search *", @@ -250081,11 +250081,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -250094,6 +250089,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "attacker_tools_on_endpoint_filter", "definition": "search *", @@ -250385,11 +250385,6 @@ "definition": "(process_name= \"arp.exe\" OR process_name= \"at.exe\" OR process_name= \"attrib.exe\" OR process_name= \"cscript.exe\" OR process_name= \"dsquery.exe\" OR process_name= \"hostname.exe\" OR process_name= \"ipconfig.exe\" OR process_name= \"mimikatz.exe\" OR process_name= \"nbstat.exe\" OR process_name= \"net.exe\" OR process_name= \"netsh.exe\" OR process_name= \"nslookup.exe\" OR process_name= \"ping.exe\" OR process_name= \"quser.exe\" OR process_name= \"qwinsta.exe\" OR process_name= \"reg.exe\" OR process_name= \"runas.exe\" OR process_name= \"sc.exe\" OR process_name= \"schtasks.exe\" OR process_name= \"ssh.exe\" OR process_name= \"systeminfo.exe\" OR process_name= \"taskkill.exe\" OR process_name= \"telnet.exe\" OR process_name= \"tracert.exe\" OR process_name=\"wscript.exe\" OR process_name= \"xcopy.exe\")", "description": "This macro is a list of process that can be used to discover the network configuration" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -250398,6 +250393,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_processes_used_for_system_network_configuration_discovery_filter", "definition": "search *", @@ -250615,11 +250615,6 @@ "definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -250628,6 +250623,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "rundll32_shimcache_flush_filter", "definition": "search *", @@ -250840,6 +250840,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_copy", "definition": "(Processes.process_name=copy.exe OR Processes.original_file_name=copy.exe OR Processes.process_name=xcopy.exe OR Processes.original_file_name=xcopy.exe)", @@ -250850,14 +250858,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "suspicious_copy_on_system32_filter", "definition": "search *", @@ -251100,11 +251100,6 @@ "definition": "lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true", "description": "This macro limits the output to process names that are in the Windows System directory" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -251113,6 +251108,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "system_processes_run_from_unexpected_locations_filter", "definition": "search *", @@ -251310,11 +251310,6 @@ "definition": "(Processes.process_name=verclsid.exe OR Processes.original_file_name=verclsid.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -251323,6 +251318,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "verclsid_clsid_execution_filter", "definition": "search *", @@ -251597,11 +251597,6 @@ "definition": "lookup update=true is_net_windows_file filename as process_name OUTPUT netFile | lookup update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile | search netFile=true", "description": "This macro limits the output to process names that are .net binaries on Windows Server 2016 and Windows 11." }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -251610,6 +251605,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_dotnet_binary_in_non_standard_path_filter", "definition": "search *", @@ -251884,11 +251884,6 @@ "definition": "(Processes.process_name=installutil.exe OR Processes.original_file_name=InstallUtil.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -251897,6 +251892,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_installutil_in_non_standard_path_filter", "definition": "search *", @@ -252184,11 +252184,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -252197,6 +252192,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_nirsoft_advancedrun_filter", "definition": "search *", @@ -252426,11 +252426,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -252439,6 +252434,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "wscript_or_cscript_suspicious_child_process_filter", "definition": "search *", @@ -252613,11 +252613,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "filter_rare_process_allow_list", "definition": "lookup update=true lookup_rare_process_allow_list_default process as process OUTPUTNEW allow_list | where allow_list=\"false\" | lookup update=true lookup_rare_process_allow_list_local process as process OUTPUT allow_list | where allow_list=\"false\"", @@ -252631,6 +252626,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_rare_executables_filter", "definition": "search *", @@ -252800,11 +252800,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -252813,6 +252808,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "unusually_long_command_line_filter", "definition": "search *", @@ -253033,11 +253033,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -253046,6 +253041,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "unusually_long_command_line___mltk_filter", "definition": "search *", @@ -253229,11 +253229,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -253242,6 +253237,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "winrm_spawning_a_process_filter", "definition": "search *", @@ -253686,11 +253686,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -253699,6 +253694,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "protocols_passing_authentication_in_cleartext_filter", "definition": "search *", @@ -254124,11 +254124,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -254137,6 +254132,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "add_or_set_windows_defender_exclusion_filter", "definition": "search *", @@ -254430,11 +254430,6 @@ "definition": "(Processes.process_name=\"net.exe\" OR Processes.original_file_name=\"net.exe\" OR Processes.process_name=\"net1.exe\" OR Processes.original_file_name=\"net1.exe\")", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -254443,6 +254438,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "attempt_to_stop_security_service_filter", "definition": "search *", @@ -254698,6 +254698,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_cmd", "definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)", @@ -254708,14 +254716,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "cmd_carry_out_string_command_parameter_filter", "definition": "search *", @@ -255190,11 +255190,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -255203,6 +255198,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "executables_or_script_creation_in_suspicious_path_filter", "definition": "search *", @@ -255674,11 +255674,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -255687,6 +255682,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "impacket_lateral_movement_commandline_parameters_filter", "definition": "search *", @@ -255959,9 +255959,12 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] }, { "name": "process_powershell", @@ -255969,12 +255972,9 @@ "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "malicious_powershell_process___encoded_command_filter", @@ -256199,9 +256199,9 @@ }, "macros": [ { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" + "name": "process_ping", + "definition": "(Processes.process_name=ping.exe OR Processes.original_file_name=ping.exe)", + "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, { "name": "security_content_ctime", @@ -256212,9 +256212,9 @@ ] }, { - "name": "process_ping", - "definition": "(Processes.process_name=ping.exe OR Processes.original_file_name=ping.exe)", - "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" }, { "name": "ping_sleep_batch_command_filter", @@ -257353,11 +257353,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -257366,6 +257361,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_process_file_path_filter", "definition": "search *", @@ -257917,11 +257917,6 @@ "definition": "lookup update=true is_net_windows_file filename as process_name OUTPUT netFile | lookup update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile | search netFile=true", "description": "This macro limits the output to process names that are .net binaries on Windows Server 2016 and Windows 11." }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -257930,6 +257925,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_dotnet_binary_in_non_standard_path_filter", "definition": "search *", @@ -258204,11 +258204,6 @@ "definition": "(Processes.process_name=installutil.exe OR Processes.original_file_name=InstallUtil.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -258217,6 +258212,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_installutil_in_non_standard_path_filter", "definition": "search *", @@ -258504,11 +258504,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -258517,6 +258512,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_nirsoft_advancedrun_filter", "definition": "search *", @@ -258799,11 +258799,6 @@ "definition": "lookup update=true is_nirsoft_software filename as process_name OUTPUT nirsoftFile | search nirsoftFile=true", "description": "This macro is related to potentially identifiable software related to NirSoft. Remove or filter as needed based." }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -258812,6 +258807,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_nirsoft_utilities_filter", "definition": "search *", @@ -259041,11 +259041,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -259054,6 +259049,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "wscript_or_cscript_suspicious_child_process_filter", "definition": "search *", @@ -259293,11 +259293,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -259306,6 +259301,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "reg_exe_used_to_hide_files_directories_via_registry_keys_filter", "definition": "search *", @@ -259449,11 +259449,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -259462,6 +259457,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "remote_registry_key_modifications_filter", "definition": "search *", @@ -259682,11 +259682,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -259695,6 +259690,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "add_or_set_windows_defender_exclusion_filter", "definition": "search *", @@ -259928,6 +259928,14 @@ ] }, "macros": [ + { + "name": "security_content_ctime", + "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", + "description": "convert epoch time to string", + "arguments": [ + "field" + ] + }, { "name": "process_csc", "definition": "(Processes.process_name=csc.exe OR Processes.original_file_name=csc.exe)", @@ -259938,14 +259946,6 @@ "definition": "summariesonly=false allow_old_summaries=true", "description": "search data model's summaries only" }, - { - "name": "security_content_ctime", - "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", - "description": "convert epoch time to string", - "arguments": [ - "field" - ] - }, { "name": "csc_net_on_the_fly_compilation_filter", "definition": "search *", @@ -261933,11 +261933,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "process_netsh", "definition": "(Processes.process_name=netsh.exe OR Processes.original_file_name=netsh.exe)", @@ -261951,6 +261946,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "disabling_firewall_with_netsh_filter", "definition": "search *", @@ -263519,11 +263519,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -263532,6 +263527,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "excessive_number_of_service_control_start_as_disabled_filter", "definition": "search *", @@ -263714,11 +263714,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -263727,6 +263722,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "firewall_allowed_program_enable_filter", "definition": "search *", @@ -263976,11 +263976,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -263989,6 +263984,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "fodhelper_uac_bypass_filter", "definition": "search *", @@ -264223,11 +264223,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -264236,6 +264231,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "hiding_files_and_directories_with_attrib_exe_filter", "definition": "search *", @@ -264425,11 +264425,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -264438,6 +264433,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "net_profiler_uac_bypass_filter", "definition": "search *", @@ -265264,11 +265264,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -265277,6 +265272,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "slui_runas_elevated_filter", "definition": "search *", @@ -265486,11 +265486,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -265499,6 +265494,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "slui_spawning_a_process_filter", "definition": "search *", @@ -265730,11 +265730,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -265743,6 +265738,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_reg_exe_process_filter", "definition": "search *", @@ -266359,11 +266359,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -266372,6 +266367,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_disableantispyware_registry_filter", "definition": "search *", @@ -266623,11 +266623,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -266636,6 +266631,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "windows_dism_remove_defender_filter", "definition": "search *", @@ -267304,11 +267304,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -267317,6 +267312,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "net_localgroup_discovery_filter", "definition": "search *", @@ -267540,13 +267540,13 @@ }, "macros": [ { - "name": "stream_dns", - "definition": "sourcetype=stream:dns", + "name": "stream_tcp", + "definition": "sourcetype=stream:tcp", "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." }, { - "name": "stream_tcp", - "definition": "sourcetype=stream:tcp", + "name": "stream_dns", + "definition": "sourcetype=stream:dns", "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." }, { @@ -268058,11 +268058,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -268071,6 +268066,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "execution_of_file_with_spaces_before_extension_filter", "definition": "search *", @@ -268237,11 +268237,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -268250,6 +268245,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_changes_to_file_associations_filter", "definition": "search *", @@ -268502,11 +268502,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -268515,6 +268510,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "execution_of_file_with_multiple_extensions_filter", "definition": "search *", @@ -269050,11 +269050,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -269063,6 +269058,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "deleting_shadow_copies_filter", "definition": "search *", @@ -269527,11 +269527,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -269540,6 +269535,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_wevtutil_usage_filter", "definition": "search *", @@ -269748,11 +269748,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -269761,6 +269756,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "usn_journal_deletion_filter", "definition": "search *", @@ -269998,11 +269998,6 @@ "definition": "eventtype=wineventlog_security", "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." }, - { - "name": "wineventlog_system", - "definition": "eventtype=wineventlog_system", - "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -270011,6 +270006,11 @@ "field" ] }, + { + "name": "wineventlog_system", + "definition": "eventtype=wineventlog_system", + "description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent." + }, { "name": "windows_event_log_cleared_filter", "definition": "search *", @@ -270474,11 +270474,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -270487,6 +270482,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "reg_exe_used_to_hide_files_directories_via_registry_keys_filter", "definition": "search *", @@ -270630,11 +270630,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -270643,6 +270638,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "remote_registry_key_modifications_filter", "definition": "search *", @@ -271058,11 +271058,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -271071,6 +271066,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "certutil_exe_certificate_extraction_filter", "definition": "search *", @@ -271268,11 +271268,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -271281,6 +271276,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "change_default_file_association_filter", "definition": "search *", @@ -271538,11 +271538,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -271551,6 +271546,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "detect_path_interception_by_creation_of_program_exe_filter", "definition": "search *", @@ -271989,11 +271989,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -272002,6 +271997,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "hiding_files_and_directories_with_attrib_exe_filter", "definition": "search *", @@ -272201,11 +272201,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -272214,6 +272209,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "logon_script_event_trigger_execution_filter", "definition": "search *", @@ -272655,11 +272655,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -272668,6 +272663,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "reg_exe_manipulating_windows_services_registry_keys_filter", "definition": "search *", @@ -273426,11 +273426,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -273439,6 +273434,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "sc_exe_manipulating_windows_services_filter", "definition": "search *", @@ -274067,11 +274067,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -274080,6 +274075,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "schtasks_used_for_forcing_a_reboot_filter", "definition": "search *", @@ -274256,11 +274256,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -274269,6 +274264,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "screensaver_event_trigger_execution_filter", "definition": "search *", @@ -274476,11 +274476,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -274489,6 +274484,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "shim_database_file_creation_filter", "definition": "search *", @@ -274699,11 +274699,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -274712,6 +274707,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "shim_database_installation_with_suspicious_parameters_filter", "definition": "search *", @@ -274952,11 +274952,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -274965,6 +274960,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_scheduled_task_from_public_directory_filter", "definition": "search *", @@ -276094,11 +276094,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -276107,6 +276102,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "print_processor_registry_autostart_filter", "definition": "search *", @@ -276613,11 +276613,6 @@ "definition": "lookup update=true lookup_uncommon_processes_default process_name as process_name outputnew uncommon_default,category_default,analytic_story_default,kill_chain_phase_default,mitre_attack_default | lookup update=true lookup_uncommon_processes_local process_name as process_name outputnew uncommon_local,category_local,analytic_story_local,kill_chain_phase_local,mitre_attack_local | eval uncommon = coalesce(uncommon_default, uncommon_local), analytic_story = coalesce(analytic_story_default, analytic_story_local), category=coalesce(category_default, category_local), kill_chain_phase=coalesce(kill_chain_phase_default, kill_chain_phase_local), mitre_attack=coalesce(mitre_attack_default, mitre_attack_local) | fields - analytic_story_default, analytic_story_local, category_default, category_local, kill_chain_phase_default, kill_chain_phase_local, mitre_attack_default, mitre_attack_local, uncommon_default, uncommon_local | search uncommon=true", "description": "This macro limits the output to processes that have been marked as uncommon" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -276626,6 +276621,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "uncommon_processes_on_endpoint_filter", "definition": "search *", @@ -277024,11 +277024,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -277037,6 +277032,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "change_default_file_association_filter", "definition": "search *", @@ -277653,11 +277653,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -277666,6 +277661,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "logon_script_event_trigger_execution_filter", "definition": "search *", @@ -278079,11 +278079,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -278092,6 +278087,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "overwriting_accessibility_binaries_filter", "definition": "search *", @@ -278489,11 +278489,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "process_runas", "definition": "(Processes.process_name=runas.exe OR Processes.original_file_name=runas.exe)", @@ -278507,6 +278502,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "runas_execution_in_commandline_filter", "definition": "search *", @@ -278683,11 +278683,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -278696,6 +278691,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "screensaver_event_trigger_execution_filter", "definition": "search *", @@ -279095,11 +279095,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -279108,6 +279103,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "child_processes_of_spoolsv_exe_filter", "definition": "search *", @@ -279304,11 +279304,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -279317,6 +279312,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "print_processor_registry_autostart_filter", "definition": "search *", @@ -279822,11 +279822,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -279835,6 +279830,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "reg_exe_manipulating_windows_services_registry_keys_filter", "definition": "search *", @@ -280092,11 +280092,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -280105,6 +280100,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "sc_exe_manipulating_windows_services_filter", "definition": "search *", @@ -281013,11 +281013,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -281026,6 +281021,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "attacker_tools_on_endpoint_filter", "definition": "search *", @@ -281241,11 +281241,6 @@ "definition": "(Processes.process_name=\"net.exe\" OR Processes.original_file_name=\"net.exe\" OR Processes.process_name=\"net1.exe\" OR Processes.original_file_name=\"net1.exe\")", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -281254,6 +281249,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "deleting_of_net_users_filter", "definition": "search *", @@ -281682,11 +281682,6 @@ "definition": "(Processes.process_name=\"net.exe\" OR Processes.original_file_name=\"net.exe\" OR Processes.process_name=\"net1.exe\" OR Processes.original_file_name=\"net1.exe\")", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -281695,6 +281690,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "disabling_net_user_account_filter", "definition": "search *", @@ -282356,11 +282356,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -282369,6 +282364,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "excessive_attempt_to_disable_services_filter", "definition": "search *", @@ -282569,11 +282569,6 @@ "definition": "(Processes.process_name=\"net.exe\" OR Processes.original_file_name=\"net.exe\" OR Processes.process_name=\"net1.exe\" OR Processes.original_file_name=\"net1.exe\")", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -282582,6 +282577,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "excessive_service_stop_attempt_filter", "definition": "search *", @@ -282766,11 +282766,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -282779,6 +282774,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "excessive_usage_of_cacls_app_filter", "definition": "search *", @@ -282996,11 +282996,6 @@ "definition": "(Processes.process_name=\"net.exe\" OR Processes.original_file_name=\"net.exe\" OR Processes.process_name=\"net1.exe\" OR Processes.original_file_name=\"net1.exe\")", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -283009,6 +283004,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "excessive_usage_of_net_app_filter", "definition": "search *", @@ -283234,11 +283234,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -283247,6 +283242,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "excessive_usage_of_taskkill_filter", "definition": "search *", @@ -283472,11 +283472,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -283485,6 +283480,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "executables_or_script_creation_in_suspicious_path_filter", "definition": "search *", @@ -283904,11 +283904,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -283917,6 +283912,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "icacls_deny_command_filter", "definition": "search *", @@ -284108,11 +284108,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -284121,6 +284116,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "icacls_grant_command_filter", "definition": "search *", @@ -284291,11 +284291,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -284304,6 +284299,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "modify_acl_permission_to_files_or_folder_filter", "definition": "search *", @@ -284523,11 +284523,6 @@ "definition": "(Processes.process_name=wmic.exe OR Processes.original_file_name=wmic.exe)", "description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/" }, - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -284536,6 +284531,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "process_kill_base_on_file_path_filter", "definition": "search *", @@ -284727,11 +284727,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -284740,6 +284735,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "schtasks_run_task_on_demand_filter", "definition": "search *", @@ -285166,11 +285166,6 @@ ] }, "macros": [ - { - "name": "security_content_summariesonly", - "definition": "summariesonly=false allow_old_summaries=true", - "description": "search data model's summaries only" - }, { "name": "security_content_ctime", "definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)", @@ -285179,6 +285174,11 @@ "field" ] }, + { + "name": "security_content_summariesonly", + "definition": "summariesonly=false allow_old_summaries=true", + "description": "search data model's summaries only" + }, { "name": "suspicious_process_file_path_filter", "definition": "search *", diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index 214b73d2f4..1fbf252fef 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index 587c1faa18..eed3dffa8a 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml index 816d89871e..70181cd3b4 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml index 9299986d2a..4332fa1c96 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml index c06001605c..4614258582 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml index 6de2deba26..4637361aa6 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml index e7181b921c..9646b119e2 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml index 6939ecd16f..f05a6bae68 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml index 24a64efbfb..ecf1756e0a 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml index 0c0cdc8c67..de5a100812 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml index e5b04d7628..3344b1683e 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml index a102d45501..4139fbd9ba 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml index 60ca24602c..320121ae80 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml index dd09348cf8..0ea49199c7 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml index 74073136e0..657d435cac 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml index c64fba94b7..5d02a8feb8 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml index 8628b0be7c..0e1e847d21 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_dns_server_history_for_a_host___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_dns_server_history_for_a_host___response_task.xml index 16941e1cf9..77d4444e62 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_dns_server_history_for_a_host___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_dns_server_history_for_a_host___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_dns_traffic_ratio___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_dns_traffic_ratio___response_task.xml index 1a55fe3587..a90ad16519 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_dns_traffic_ratio___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_dns_traffic_ratio___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml index c4b7ec3605..295895b0df 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml index d895f869f9..4f2a9ff11e 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_email_info___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_email_info___response_task.xml index f4cc584f19..b77e61a191 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_email_info___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_email_info___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_emails_from_specific_sender___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_emails_from_specific_sender___response_task.xml index 2b8b913a84..9b307ec841 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_emails_from_specific_sender___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_emails_from_specific_sender___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml index 5234afe5d8..782bc0d22a 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_history_of_email_sources___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_history_of_email_sources___response_task.xml index ca4252ef2b..d3cd7b8fdb 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_history_of_email_sources___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_history_of_email_sources___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml index 1246237a91..ede1c025ad 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml index 826cb12b91..2fc2cc1fc3 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_notable_history___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_notable_history___response_task.xml index adde4c732e..c938bb0172 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_notable_history___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_notable_history___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml index 2f45c7b560..c4d69e301d 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_process_file_activity___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_process_file_activity___response_task.xml index b8ef5bdb81..c569f096e4 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_process_file_activity___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_process_file_activity___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml index d4f3031530..282e49e056 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_process_information_for_port_activity___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_process_information_for_port_activity___response_task.xml index bb0c17e296..cfe83af3f3 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_process_information_for_port_activity___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_process_information_for_port_activity___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_process_responsible_for_the_dns_traffic___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_process_responsible_for_the_dns_traffic___response_task.xml index 3dce0d9e16..d3ef6549b7 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_process_responsible_for_the_dns_traffic___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_process_responsible_for_the_dns_traffic___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml index d352313c6a..6b59d3375a 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml index c7b4b9f589..b7d765224f 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml index c3ecd3ae93..547faf3e98 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml index 4b657801f0..1f68e3bd73 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task.xml index 0e4299570d..d96874f219 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_network_traffic_from_src_ip___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_network_traffic_from_src_ip___response_task.xml index 0be1a8b64e..5c86177415 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_network_traffic_from_src_ip___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_network_traffic_from_src_ip___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml index 5c14deddce..59ba19eb71 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_hash_attempts___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_hash_attempts___response_task.xml index 5e7f39c875..6d0f177d7c 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_hash_attempts___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_hash_attempts___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_ticket_attempts___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_ticket_attempts___response_task.xml index 6515e5146b..fbad8a40f8 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_ticket_attempts___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_ticket_attempts___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_previous_unseen_user___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_previous_unseen_user___response_task.xml index 8512a95419..8a75b39207 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_previous_unseen_user___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_previous_unseen_user___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_successful_remote_desktop_authentications___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_successful_remote_desktop_authentications___response_task.xml index 3be55fb6e8..e41143209b 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_successful_remote_desktop_authentications___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_successful_remote_desktop_authentications___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml index 41b39cf866..d5e2f61dd7 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml index 5257a47057..d550447cf9 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_web_posts_from_src___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_web_posts_from_src___response_task.xml index b4341b3b3b..a6b2b26a29 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_web_posts_from_src___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_web_posts_from_src___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index b07dddc2f0..f47ecfd900 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 6a7b9653f8..be6cd62448 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 6fd38e4566..1e4459276f 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index c4cbe4dd50..f2c874c2e9 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/workflow_actions.conf b/dist/escu/default/workflow_actions.conf index e5cb9f6012..fb04cfaa16 100644 --- a/dist/escu/default/workflow_actions.conf +++ b/dist/escu/default/workflow_actions.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-02-15T08:03:03 UTC +# On Date: 2022-02-15T08:43:14 UTC # Author: Splunk Security Research # Contact: research@splunk.com #############