Merge branch 'inthewild' of https://github.com/splunk/security_content into inthewild

2026-06-08 17:32:49 +00:00 · 2022-04-04 11:43:14 -06:00
parent ea7ce6d0c5 2f10a846b6
commit f470131cce
124 changed files with 233 additions and 152 deletions
@@ -0,0 +1,72 @@
+name: GitHub Actions Disable Security Workflow
+id: 0459f1a5-c0ac-4987-82d6-65081209f854
+version: 1
+date: '2022-04-04'
+author: Patrick Bareiss, Splunk
+type: Anomaly
+datamodel: []
+description: This search detects a disabled security workflow in GitHub Actions. 
+  An attacker can disable a security workflow in GitHub actions to hide malicious code in it.
+search: '`github` workflow_run.event=push OR workflow_run.event=pull_request
+  | stats values(workflow_run.name) as workflow_run.name by workflow_run.head_commit.id workflow_run.event workflow_run.head_branch workflow_run.head_commit.author.email 
+  workflow_run.head_commit.author.name workflow_run.head_commit.message workflow_run.head_commit.timestamp 	
+  workflow_run.head_repository.full_name workflow_run.head_repository.owner.id workflow_run.head_repository.owner.login 	
+  workflow_run.head_repository.owner.type
+  | rename workflow_run.head_commit.author.name as user, workflow_run.head_commit.author.email as user_email, workflow_run.head_repository.full_name as repository, 
+  workflow_run.head_branch as branch
+  | search NOT workflow_run.name=*security-testing* 
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` 
+  | `github_actions_disable_security_workflow_filter`'
+how_to_implement: You must index GitHub logs. You can follow the url in reference
+  to onboard GitHub logs. Sometimes GitHub logs are truncated, make sure to disable it in props.conf.
+  Replace *security-testing* with the name of your security testing workflow in GitHub Actions.
+known_false_positives: unknown
+references:
+- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
+tags:
+  analytic_story:
+  - Dev Sec Ops
+  asset_type: GitHub
+  cis20:
+  - CIS 13
+  confidence: 90
+  context:
+  - Source:Application Log
+  - Stage:Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/github_actions_disable_security_workflow/github_actions_disable_security_workflow.log
+  impact: 30
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Security Workflow is disabled in branch $branch$ for repository $repository$
+  mitre_attack_id:
+  - T1195.002
+  - T1195
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: repository
+    type: Unknown
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - workflow_run.event
+  - workflow_run.name
+  - workflow_run.head_commit.id
+  - workflow_run.event workflow_run.head_branch
+  - workflow_run.head_commit.author.email
+  - workflow_run.head_commit.author.name
+  - workflow_run.head_commit.message
+  - workflow_run.head_commit.timestamp
+  - workflow_run.head_repository.full_name
+  - workflow_run.head_repository.owner.id
+  - workflow_run.head_repository.owner.login
+  - workflow_run.head_repository.owner.type
+  risk_score: 27
+  security_domain: network
@@ -10,11 +10,11 @@ description: This search is to detect a pushed or commit to master or main branc
  Ideally in terms of devsecops the changes made in a branch and do a PR for review.
  of course in some cases admin of the project may did a changes directly to master
  branch
-search: '`github` branches{}.name = main OR branches{}.name = master | eval severity="low"
-  | eval phase="code" |  stats count min(_time) as firstTime max(_time) as lastTime  by
-  commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message
-  repository.pushed_at commit.commit.committer.date, phase, severity | eval phase="code"
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_commit_changes_in_master_filter`'
+search: '`github` branches{}.name = main OR branches{}.name = master 
+ |  stats count min(_time) as firstTime max(_time) as lastTime by commit.commit.author.email commit.author.login commit.commit.message
+  repository.pushed_at commit.commit.committer.date repository.full_name
+ | rename commit.author.login as user, repository.full_name as repository
+ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_commit_changes_in_master_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs related to github logs having the fork, commit, push metadata that can be use
  to monitor the changes in a github project.
@@ -9,7 +9,7 @@ datamodel:
 description: This analytic is to look for possible elevation control access using
  a common known process in linux platform to change the attribute and file ownership.
  This technique is commonly abused by adversaries, malware author and red teamers
-  to gain persistence or privilege escalation on the target or compromised host. Tis
+  to gain persistence or privilege escalation on the target or compromised host. This
  common process is used to modify file attribute, file ownership or SUID. This tools
  can be used in legitimate purposes so filter is needed.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -1,7 +1,7 @@
 name: Windows Event For Service Disabled
 id: 9c2620a8-94a1-11ec-b40c-acde48001122
-version: 1
-date: '2022-02-23'
+version: 2
+date: '2022-04-04'
 author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
@@ -10,10 +10,11 @@ description: This analytic will identify suspicious system event of services tha
  was modified from start to disabled. This technique is seen where the adversary
  attempts to disable security app services, other malware services to evade the defense
  systems on the compromised host
-search: '`wineventlog_system` EventCode=7040 Message = "*service was changed from
-  demand start to disabled." | stats count min(_time) as firstTime max(_time) as lastTime
-  by ComputerName EventCode Message User Sid | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `windows_event_for_service_disabled_filter`'
+search: '`wineventlog_system` EventCode=7040  Message = "*service was changed from demand start to disabled." 
+  | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode Message User Sid service service_name
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_event_for_service_disabled_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the Service name, Service File Name Service Start type, and Service Type
  from your endpoints.
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-31T20:50:18 UTC
+# On Date: 2022-04-01T17:31:05 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -4408,7 +4408,7 @@ providing_technologies = []
 type = detection
 asset_type = endpoint
 confidence = medium
-explanation = This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story. It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically 1. Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` 2. Call back to malicious LDAP server eg. Exploit.class 3. Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001 Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking into 2 or more phases showing up in detections triggerd is how this correlation search finds exploitation. If we get a notable from this correlation search the best way to triage it is by investigating the affected systems against Log4Shell exploitation using Splunk SOAR playbooks.
+explanation = This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story. It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically> Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` Call back to malicious LDAP server eg. Exploit.class Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001 Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking into 2 or more phases showing up in detections triggerd is how this correlation search finds exploitation. If we get a notable from this correlation search the best way to triage it is by investigating the affected systems against Log4Shell exploitation using Splunk SOAR playbooks.
 how_to_implement = To implement this correlation search a user needs to enable all detections in the Log4Shell Analytic Story and confirm it is generation risk events. A simple search `index=risk analyticstories="Log4Shell CVE-2021-44228"` should contain events.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1105", "T1190", "T1059"], "nist": ["DE.CM"]}
 known_false_positives = There are no known false positive for this search, but it could contain false positives as multiple detections can trigger and not have successful exploitation.
@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 6973
+build = 6992

 [triggers]
 reload.analytic_stories = simple
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-31T20:50:18 UTC
+# On Date: 2022-04-01T17:31:05 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-31T20:50:18 UTC
+# On Date: 2022-04-01T17:31:05 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-31T20:50:18 UTC
+# On Date: 2022-04-01T17:31:05 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-31T20:50:18 UTC
+# On Date: 2022-04-01T17:31:05 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -18815,10 +18815,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
 [ESCU - Log4Shell CVE-2021-44228 Exploitation - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story. It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically 1. Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` 2. Call back to malicious LDAP server eg. Exploit.class 3. Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001 Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking into 2 or more phases showing up in detections triggerd is how this correlation search finds exploitation. If we get a notable from this correlation search the best way to triage it is by investigating the affected systems against Log4Shell exploitation using Splunk SOAR playbooks.
+description = This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story. It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically> Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` Call back to malicious LDAP server eg. Exploit.class Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001 Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking into 2 or more phases showing up in detections triggerd is how this correlation search finds exploitation. If we get a notable from this correlation search the best way to triage it is by investigating the affected systems against Log4Shell exploitation using Splunk SOAR playbooks.
 action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1105", "T1190", "T1059"], "nist": ["DE.CM"]}
 action.escu.data_models = ["Risk"]
-action.escu.eli5 = This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story. It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically 1. Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` 2. Call back to malicious LDAP server eg. Exploit.class 3. Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001 Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking into 2 or more phases showing up in detections triggerd is how this correlation search finds exploitation. If we get a notable from this correlation search the best way to triage it is by investigating the affected systems against Log4Shell exploitation using Splunk SOAR playbooks.
+action.escu.eli5 = This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story. It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically> Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` Call back to malicious LDAP server eg. Exploit.class Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001 Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking into 2 or more phases showing up in detections triggerd is how this correlation search finds exploitation. If we get a notable from this correlation search the best way to triage it is by investigating the affected systems against Log4Shell exploitation using Splunk SOAR playbooks.
 action.escu.how_to_implement = To implement this correlation search a user needs to enable all detections in the Log4Shell Analytic Story and confirm it is generation risk events. A simple search `index=risk analyticstories="Log4Shell CVE-2021-44228"` should contain events.
 action.escu.known_false_positives = There are no known false positive for this search, but it could contain false positives as multiple detections can trigger and not have successful exploitation.
 action.escu.creation_date = 2022-01-26
@@ -18843,7 +18843,7 @@ action.correlationsearch.annotations = {"analytic_story": ["Log4Shell CVE-2021-4
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = []
-action.notable.param.rule_description = This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story. It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically 1. Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` 2. Call back to malicious LDAP server eg. Exploit.class 3. Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001 Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking into 2 or more phases showing up in detections triggerd is how this correlation search finds exploitation. If we get a notable from this correlation search the best way to triage it is by investigating the affected systems against Log4Shell exploitation using Splunk SOAR playbooks.
+action.notable.param.rule_description = This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story. It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically> Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` Call back to malicious LDAP server eg. Exploit.class Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001 Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking into 2 or more phases showing up in detections triggerd is how this correlation search finds exploitation. If we get a notable from this correlation search the best way to triage it is by investigating the affected systems against Log4Shell exploitation using Splunk SOAR playbooks.
 action.notable.param.rule_title = Log4Shell CVE-2021-44228 Exploitation
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-31T20:50:18 UTC
+# On Date: 2022-04-01T17:31:05 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-31T20:50:18 UTC
+# On Date: 2022-04-01T17:31:05 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -99,8 +99,8 @@ This search returns a list of hosts that have not successfully completed a backu

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)

 Note that **extended_period_without_successful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -98,8 +98,8 @@ This search gives you the hosts where a backup was attempted and then failed.

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)

 Note that **unsuccessful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -96,8 +96,8 @@ This search looks for DNS requests for faux domains similar to the domains that
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml)

 Note that **monitor_dns_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -122,8 +122,8 @@ This search will detect users creating spikes in API activity related to network

 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [network_acl_events](https://github.com/splunk/security_content/blob/develop/macros/network_acl_events.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)

 Note that **detect_spike_in_network_acl_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -111,8 +111,8 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote
 #### Macros
 The SPL above uses the following Macros:
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **remote_wmi_command_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -100,8 +100,8 @@ The search looks for files created with names that have been linked to malicious
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml)

 Note that **suspicious_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -102,8 +102,8 @@ This search looks for applications on the endpoint that you have marked as prohi

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **prohibited_software_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -113,9 +113,9 @@ This search will return a table of rare processes, the names of the systems runn

 #### Macros
 The SPL above uses the following Macros:
+* [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml)

 Note that **detect_rare_executables_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -113,9 +113,9 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no

 #### Macros
 The SPL above uses the following Macros:
-* [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml)

 Note that **first_time_seen_child_process_of_zoom_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -123,14 +123,14 @@ This search looks for DNS requests for phishing domains that are leveraging Evil

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml)
 * [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml)
-* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml)
 * [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml)
-* [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml)
+* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml)
+* [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml)
 * [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml)
+* [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml)
 * [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -109,9 +109,9 @@ This search looks for web connections to dynamic DNS providers.

 #### Macros
 The SPL above uses the following Macros:
+* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml)

 Note that **detect_web_traffic_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -119,8 +119,8 @@ This search looks for EC2 instances being modified by users who have not previou
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [ec2_modification_api_calls](https://github.com/splunk/security_content/blob/develop/macros/ec2_modification_api_calls.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)

 Note that **ec2_instance_modified_with_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -116,9 +116,9 @@ This search looks for PowerShell processes started with parameters used to bypas

 #### Macros
 The SPL above uses the following Macros:
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)

 Note that **malicious_powershell_process_-_execution_policy_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -118,8 +118,8 @@ This search looks for emails that have attachments with suspicious file extensio
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **suspicious_email_attachment_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -109,8 +109,8 @@ The search looks for file modifications with extensions commonly used by Ransomw

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [ransomware_extensions](https://github.com/splunk/security_content/blob/develop/macros/ransomware_extensions.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **common_ransomware_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -109,8 +109,8 @@ The search looks for files created with names matching those typically used in r
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [ransomware_notes](https://github.com/splunk/security_content/blob/develop/macros/ransomware_notes.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **common_ransomware_notes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -113,10 +113,10 @@ This search looks for executions of cmd.exe spawned by a process that is often a

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **detect_prohibited_applications_spawning_cmd_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -107,9 +107,9 @@ The following analytic identifies microsoft.workflow.compiler.exe usage. microso

 #### Macros
 The SPL above uses the following Macros:
+* [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml)

 Note that **suspicious_microsoft_workflow_compiler_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -122,9 +122,9 @@ The following analytic identifies renamed instances of msbuild.exe executing. Ms

 #### Macros
 The SPL above uses the following Macros:
+* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)

 Note that **suspicious_msbuild_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -112,9 +112,9 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi

 #### Macros
 The SPL above uses the following Macros:
+* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)

 Note that **suspicious_msbuild_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -112,9 +112,9 @@ Malicious actors often abuse legitimate Dynamic DNS services to host malicious p

 #### Macros
 The SPL above uses the following Macros:
+* [dynamic_dns_providers](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_providers.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [dynamic_dns_providers](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_providers.yml)

 Note that **detect_hosts_connecting_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -118,9 +118,9 @@ This search looks for PowerShell processes launched with arguments that have cha

 #### Macros
 The SPL above uses the following Macros:
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)

 Note that **malicious_powershell_process_with_obfuscation_techniques_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -112,8 +112,8 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **suspicious_mshta_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -112,9 +112,9 @@ The following analytic identifies the use of PowerShell downloading a file using

 #### Macros
 The SPL above uses the following Macros:
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)

 Note that **any_powershell_downloadfile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -107,9 +107,9 @@ The following analytic identifies the use of PowerShell downloading a file using

 #### Macros
 The SPL above uses the following Macros:
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)

 Note that **any_powershell_downloadstring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -107,9 +107,9 @@ This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a

 #### Macros
 The SPL above uses the following Macros:
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)

 Note that **nishang_powershelltcponeline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -116,10 +116,10 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **w3wp_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -103,8 +103,8 @@ CertUtil.exe may be used to `encode` and `decode` a file, including PE and scrip
 #### Macros
 The SPL above uses the following Macros:
 * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **certutil_with_decode_argument_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -103,9 +103,9 @@ Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functio

 #### Macros
 The SPL above uses the following Macros:
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)

 Note that **powershell_start-bitstransfer_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -107,9 +107,9 @@ The following detection identifies Microsoft Excel spawning PowerShell. Typicall

 #### Macros
 The SPL above uses the following Macros:
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)

 Note that **excel_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -107,9 +107,9 @@ The following detection identifies Microsoft Word spawning PowerShell. Typically

 #### Macros
 The SPL above uses the following Macros:
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)

 Note that **winword_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -102,10 +102,10 @@ This search is designed to detect suspicious cmd and powershell process spawned

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **wermgr_process_spawned_cmd_or_powershell_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -107,8 +107,8 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically,

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **winword_spawning_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -108,8 +108,8 @@ The following detection identifies the latest behavior utilized by different mal
 #### Macros
 The SPL above uses the following Macros:
 * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **office_product_spawning_certutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -107,8 +107,8 @@ The following detection identifies the latest behavior utilized by different mal

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **office_product_spawning_mshta_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -108,8 +108,8 @@ The following analytic identifies the use of `wmic.exe` using `delete` to remove
 #### Macros
 The SPL above uses the following Macros:
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **process_kill_base_on_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -119,8 +119,8 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **cmd_echo_pipe_-_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -107,8 +107,8 @@ This search is to detect a suspicious commandline designed to delete files or di

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **recursive_delete_of_directory_in_batch_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -107,9 +107,9 @@ This search is to identifies a modification in registry to disable the windows d

 #### Macros
 The SPL above uses the following Macros:
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)

 Note that **powershell_disable_security_monitoring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -107,8 +107,8 @@ this search is to detect a suspicious office product process that spawn cmd chil

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **office_product_spawn_cmd_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -107,8 +107,8 @@ This search is to detect a suspicious attachment file extension in Gsuite email

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)

 Note that **gsuite_email_suspicious_attachment_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -112,8 +112,8 @@ This search is to detect a suspicious outbound e-mail from internal email to ext

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)

 Note that **gsuite_outbound_email_with_attachment_to_external_domain_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -107,9 +107,9 @@ The following analytic identifies the process - `esentutl.exe` - being used to c

 #### Macros
 The SPL above uses the following Macros:
+* [process_esentutl](https://github.com/splunk/security_content/blob/develop/macros/process_esentutl.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_esentutl](https://github.com/splunk/security_content/blob/develop/macros/process_esentutl.yml)

 Note that **esentutl_sam_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -110,8 +110,8 @@ This search is to detect a gsuite email contains suspicious subject having known

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)

 Note that **gsuite_email_suspicious_subject_with_attachment_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -103,8 +103,8 @@ This search is to detect a pushed or commit to master or main branch. This is to

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)

 Note that **github_commit_changes_in_master_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -110,8 +110,8 @@ This analytics is to detect a gmail containing a link that are known to be abuse

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)

 Note that **gsuite_email_with_known_abuse_web_service_link_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -111,8 +111,8 @@ This search uses the Kubernetes logs from Splunk Connect from Kubernetes to dete

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [kube_objects_events](https://github.com/splunk/security_content/blob/develop/macros/kube_objects_events.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)

 Note that **kubernetes_scanner_image_pulling_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -107,8 +107,8 @@ Review the source attempting to perform this activity against your environment.

 #### Macros
 The SPL above uses the following Macros:
-* [exchange](https://github.com/splunk/security_content/blob/develop/macros/exchange.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [exchange](https://github.com/splunk/security_content/blob/develop/macros/exchange.yml)

 Note that **exchange_powershell_abuse_via_ssrf_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -101,8 +101,8 @@ This search is to detect a pushed or commit to develop branch. This is to avoid

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)

 Note that **github_commit_in_develop_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -113,8 +113,8 @@ This search looks for Dependabot Alerts in Github logs.

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)

 Note that **github_dependabot_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -114,9 +114,9 @@ This search looks for Pull Request from unknown user.

 #### Macros
 The SPL above uses the following Macros:
+* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
 * [github_known_users](https://github.com/splunk/security_content/blob/develop/macros/github_known_users.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)

 Note that **github_pull_request_from_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -107,9 +107,9 @@ The following analytic identifies the use of `reg.exe` exporting Windows Registr

 #### Macros
 The SPL above uses the following Macros:
+* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml)

 Note that **extraction_of_registry_hives_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -103,8 +103,8 @@ This search is to detect a suspicious wmic.exe process or renamed wmic process t
 #### Macros
 The SPL above uses the following Macros:
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **xsl_script_execution_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -117,8 +117,8 @@ Attempt To Add Certificate To Untrusted Store
 #### Macros
 The SPL above uses the following Macros:
 * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **attempt_to_add_certificate_to_untrusted_store_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -113,10 +113,10 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **attempted_credential_dump_from_registry_via_reg_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -112,10 +112,10 @@ This search detects the use of wmic and Powershell to create a shadow copy.

 #### Macros
 The SPL above uses the following Macros:
-* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
+* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **creation_of_shadow_copy_with_wmic_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -112,8 +112,8 @@ This search detects credential dumping using copy command from a shadow copy.

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **credential_dumping_via_copy_command_from_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -112,8 +112,8 @@ This search detects the creation of a symlink to a shadow copy.

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **credential_dumping_via_symlink_to_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -113,8 +113,8 @@ The following analytic identifies a renamed instance of hh.exe (HTML Help) execu
 #### Macros
 The SPL above uses the following Macros:
 * [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **detect_html_help_renamed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -113,8 +113,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM
 #### Macros
 The SPL above uses the following Macros:
 * [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **detect_html_help_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -113,8 +113,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM
 #### Macros
 The SPL above uses the following Macros:
 * [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **detect_html_help_using_infotech_storage_handlers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -112,8 +112,8 @@ The following analytic identifies "mshta.exe" execution with inline protocol han

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **detect_mshta_inline_hta_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -112,8 +112,8 @@ The following analytic identifies renamed instances of mshta.exe executing. Msht

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **detect_mshta_renamed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -112,8 +112,8 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **detect_mshta_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -112,8 +112,8 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **detect_psexec_with_accepteula_flag_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -107,8 +107,8 @@ The following analytic identifies renamed instances of `PsExec.exe` being utiliz

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **detect_renamed_psexec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -114,8 +114,8 @@ During triage, confirm this is procdump.exe executing. If it is the first time a

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_procdump](https://github.com/splunk/security_content/blob/develop/macros/process_procdump.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **dump_lsass_via_procdump_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -108,8 +108,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
 #### Macros
 The SPL above uses the following Macros:
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **local_account_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -108,8 +108,8 @@ The following detection identifies the latest behavior utilized by Ursnif malwar
 #### Macros
 The SPL above uses the following Macros:
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **office_product_spawning_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -117,9 +117,9 @@ The following analytic identifies a renamed instance of microsoft.workflow.compi

 #### Macros
 The SPL above uses the following Macros:
+* [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml)

 Note that **suspicious_microsoft_workflow_compiler_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -107,9 +107,9 @@ This analytic is to detect a suspicious child process of MSBuild spawned by Wind

 #### Macros
 The SPL above uses the following Macros:
+* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)

 Note that **msbuild_suspicious_spawned_by_script_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -108,8 +108,8 @@ This analytic is to detect a suspicious copy of file from systemroot folder of t
 #### Macros
 The SPL above uses the following Macros:
 * [process_copy](https://github.com/splunk/security_content/blob/develop/macros/process_copy.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **suspicious_copy_on_system32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -112,8 +112,8 @@ This analytic is to detect the execution of sdelete.exe application sysinternal

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_sdelete](https://github.com/splunk/security_content/blob/develop/macros/process_sdelete.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **sdelete_application_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -109,9 +109,9 @@ During triage, review parallel processes for further suspicious activity.

 #### Macros
 The SPL above uses the following Macros:
+* [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml)

 Note that **serviceprincipalnames_discovery_with_setspn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -104,9 +104,9 @@ During triage, review parallel processes for further behavior. In addition, iden

 #### Macros
 The SPL above uses the following Macros:
+* [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml)

 Note that **windows_curl_download_to_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -104,8 +104,8 @@ The following hunting analytic assists with identifying suspicious tasks that ha

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [wineventlog_task_scheduler](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_task_scheduler.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)

 Note that **winevent_windows_task_scheduler_event_action_started_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -106,9 +106,9 @@ Adversaries may use one of the three methods based on the remote destination and

 #### Macros
 The SPL above uses the following Macros:
+* [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml)

 Note that **windows_curl_upload_to_remote_destination_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -103,8 +103,8 @@ The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible St
 #### Macros
 The SPL above uses the following Macros:
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **wmic_xsl_execution_via_url_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -107,9 +107,9 @@ this analytic is to detect a suspicious compile before delivery approach of .net

 #### Macros
 The SPL above uses the following Macros:
+* [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml)

 Note that **csc_net_on_the_fly_compilation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -107,8 +107,8 @@ This analytic look for a spawned process of route.exe windows application. Adver

 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **network_discovery_using_route_windows_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -111,8 +111,8 @@ This analytic identifies wmic.exe being launched with parameters to spawn a proc
 #### Macros
 The SPL above uses the following Macros:
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **remote_process_instantiation_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -109,9 +109,9 @@ This analytic look for a spawned runas.exe process with a administrator user opt

 #### Macros
 The SPL above uses the following Macros:
+* [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml)

 Note that **runas_execution_in_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -112,8 +112,8 @@ During triage review resulting network connections, file modifications, and para
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)

 Note that **windows_installutil_uninstall_option_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -111,8 +111,8 @@ During triage review resulting network connections, file modifications, and para
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)

 Note that **windows_installutil_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -107,9 +107,9 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize

 #### Macros
 The SPL above uses the following Macros:
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)

 Note that **remote_process_instantiation_via_dcom_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -102,9 +102,9 @@ This analytic looks for the execution of `powershell.exe` leveraging the `Invoke

 #### Macros
 The SPL above uses the following Macros:
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)

 Note that **remote_process_instantiation_via_wmi_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -107,9 +107,9 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize

 #### Macros
 The SPL above uses the following Macros:
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)

 Note that **remote_process_instantiation_via_winrm_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

@@ -103,8 +103,8 @@ This analytic is to detect a suspicious dxdiag.exe process command-line executio
 #### Macros
 The SPL above uses the following Macros:
 * [process_dxdiag](https://github.com/splunk/security_content/blob/develop/macros/process_dxdiag.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)

 Note that **system_info_gathering_using_dxdiag_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

--- a/Show More
+++ b/Show More