#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-04-04T18:01:09 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############

[__mlspl_unusual_commandline_detection]
filename = __mlspl_unusual_commandline_detection.mlmodel
default_match = false
case_sensitive_match = false
# description = An MLTK model for detecting malicious commandlines
match_type = None
min_matches = 1
fields_list = None

[api_call_by_user_baseline]
filename = None
default_match = None
case_sensitive_match = None
# description = A collection that will contain the baseline information for number of AWS API calls per user
match_type = None
min_matches = None
fields_list = arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls

[attacker_tools]
filename = attacker_tools.csv
default_match = false
case_sensitive_match = false
# description = A list of tools used by attackers
match_type = WILDCARD(attacker_tool_names)
min_matches = 1
fields_list = None

[aws_service_accounts]
filename = aws_service_accounts.csv
default_match = None
case_sensitive_match = None
# description = A lookup file that will contain AWS Service accounts
match_type = None
min_matches = None
fields_list = None

[baseline_blocked_outbound_connections]
filename = baseline_blocked_outbound_connections.csv
default_match = None
case_sensitive_match = None
# description = A lookup file that will contain the baseline information for number of blocked outbound connections
match_type = None
min_matches = None
fields_list = None

[brandMonitoring_lookup]
filename = brand_monitoring.csv
default_match = false
case_sensitive_match = None
# description = A file that contains look-a-like domains for brands that you want to monitor
match_type = WILDCARD(domain)
min_matches = 1
fields_list = None

[cloud_instances_enough_data]
filename = None
default_match = false
case_sensitive_match = None
# description = A lookup to determine if you have a sufficient amount of time has passed to collect cloud instance data for behavioral searches
match_type = WILDCARD(filter)
min_matches = None
fields_list = _key, filter, enough_data

[csc_lookup]
filename = csc_lookup.csv
default_match = None
case_sensitive_match = None
# description = The CSC control numbers and names
match_type = None
min_matches = 1
fields_list = None

[discovered_dns_records]
filename = discovered_dns_records.csv
default_match = false
case_sensitive_match = None
# description = A placeholder for a list of discovered DNS records generated by the baseline discover_dns_records
match_type = None
min_matches = 1
fields_list = None

[domains]
filename = domains.csv
default_match = None
case_sensitive_match = None
# description = A list of domains that can be ignored
match_type = None
min_matches = None
fields_list = None

[dynamic_dns_providers_default]
filename = dynamic_dns_providers_default.csv
default_match = None
case_sensitive_match = false
# description = A list of dynammic dns providers that should not be modified
match_type = WILDCARD(dynamic_dns_domains)
min_matches = None
fields_list = None

[dynamic_dns_providers_local]
filename = dynamic_dns_providers_local.csv
default_match = None
case_sensitive_match = false
# description = A list of dynammic dns providers that can be modified
match_type = WILDCARD(dynamic_dns_domains)
min_matches = None
fields_list = None

[escu_search_id_lookup]
filename = escu_search_id.csv
default_match = None
case_sensitive_match = None
# description = A placeholder lookup file to hold information for ESCU Usage dashboard
match_type = None
min_matches = None
fields_list = None

[images_to_repository]
filename = images_to_repository.csv
default_match = None
case_sensitive_match = None
# description = Mapping images to repositories
match_type = None
min_matches = None
fields_list = None

[is_net_windows_file]
filename = is_net_windows_file.csv
default_match = false
case_sensitive_match = false
# description = A full baseline of executable files in \Windows\, including sub-directories from Server 2016 and Windows 11. Certain .net binaries may not have been captured due to different Windows SDK's or developer utilities not installed during baseline.
match_type = None
min_matches = 1
fields_list = None

[is_nirsoft_software]
filename = is_nirsoft_software.csv
default_match = false
case_sensitive_match = false
# description = A subset of utilities provided by NirSoft that may be used by adversaries.
match_type = None
min_matches = 1
fields_list = None

[is_suspicious_file_extension_lookup]
filename = is_suspicious_file_extension_lookup.csv
default_match = None
case_sensitive_match = None
# description = A list of suspicious extensions for email attachments
match_type = WILDCARD(file_name)
min_matches = None
fields_list = None

[is_windows_system_file]
filename = is_windows_system_file.csv
default_match = false
case_sensitive_match = false
# description = A full baseline of executable files in Windows\System32 and Windows\Syswow64, including sub-directories from Server 2016 and Windows 10.
match_type = None
min_matches = 1
fields_list = None

[legit_domains]
filename = legit_domains.csv
default_match = None
case_sensitive_match = None
# description = A list of legit domains to be used as an ignore list for possible phishing sites
match_type = None
min_matches = None
fields_list = None

[linux_tool_discovery_process]
filename = linux_tool_discovery_process.csv
default_match = false
case_sensitive_match = false
# description = A list of suspicious bash commonly used by attackers via scripts
match_type = WILDCARD(process)
min_matches = 1
fields_list = None

[local_file_inclusion_paths]
filename = local_file_inclusion_paths.csv
default_match = false
case_sensitive_match = false
# description = A list of interesting files in a local file inclusion attack
match_type = WILDCARD(local_file_inclusion_paths)
min_matches = 1
fields_list = None

[lookup_rare_process_allow_list_default]
filename = rare_process_allow_list_default.csv
default_match = false
case_sensitive_match = false
# description = A list of rare processes that are legitimate that is provided by Splunk
match_type = WILDCARD(process)
min_matches = 1
fields_list = None

[lookup_rare_process_allow_list_local]
filename = rare_process_allow_list_local.csv
default_match = false
case_sensitive_match = false
# description = A list of rare processes that are legitimate provided by the end user
match_type = WILDCARD(process)
min_matches = 1
fields_list = None

[lookup_uncommon_processes_default]
filename = uncommon_processes_default.csv
default_match = None
case_sensitive_match = false
# description = A list of processes that are not common
match_type = WILDCARD(process)
min_matches = None
fields_list = None

[lookup_uncommon_processes_local]
filename = uncommon_processes_local.csv
default_match = None
case_sensitive_match = false
# description = A list of processes that are not common
match_type = WILDCARD(process)
min_matches = None
fields_list = None

[mandatory_job_for_workflow]
filename = mandatory_job_for_workflow.csv
default_match = None
case_sensitive_match = None
# description = A lookup file that will be used to define the mandatory job for workflow
match_type = None
min_matches = None
fields_list = None

[mandatory_step_for_job]
filename = mandatory_step_for_job.csv
default_match = None
case_sensitive_match = None
# description = A lookup file that will be used to define the mandatory step for job
match_type = None
min_matches = None
fields_list = None

[network_acl_activity_baseline]
filename = network_acl_activity_baseline.csv
default_match = None
case_sensitive_match = None
# description = A lookup file that will contain the baseline information for number of AWS Network ACL Activity
match_type = None
min_matches = None
fields_list = None

[previously_seen_S3_access_from_remote_ip]
filename = previously_seen_S3_access_from_remote_ip.csv
default_match = None
case_sensitive_match = None
# description = A placeholder for a list of IPs that have access S3
match_type = None
min_matches = None
fields_list = None

[previously_seen_api_calls_from_user_roles]
filename = previously_seen_api_calls_from_user_roles.csv
default_match = None
case_sensitive_match = None
# description = A placeholder for a list of AWS API calls for each user role
match_type = None
min_matches = None
fields_list = None

[previously_seen_aws_cross_account_activity]
filename = previously_seen_aws_cross_account_activity.csv
default_match = None
case_sensitive_match = None
# description = A placeholder for a list of AWS accounts and assumed roles
match_type = None
min_matches = None
fields_list = None

[previously_seen_aws_regions]
filename = previously_seen_aws_regions.csv
default_match = false
case_sensitive_match = None
# description = A place holder for a list of used AWS regions
match_type = None
min_matches = 1
fields_list = None

[previously_seen_cloud_api_calls_per_user_role]
filename = None
default_match = None
case_sensitive_match = None
# description = A table of users, commands, and the first and last time that they have been seen
match_type = None
min_matches = None
fields_list = _key, user, command, firstTimeSeen, lastTimeSeen, enough_data

[previously_seen_cloud_compute_creations_by_user]
filename = None
default_match = None
case_sensitive_match = None
# description = A table of previously seen users creating cloud instances
match_type = None
min_matches = None
fields_list = _key, firstTimeSeen, lastTimeSeen, user, enough_data

[previously_seen_cloud_compute_images]
filename = None
default_match = None
case_sensitive_match = None
# description = A table of previously seen Cloud image IDs
match_type = None
min_matches = None
fields_list = _key, firstTimeSeen, lastTimeSeen, image_id, enough_data

[previously_seen_cloud_compute_instance_types]
filename = None
default_match = None
case_sensitive_match = None
# description = A place holder for a list of used cloud compute instance types
match_type = None
min_matches = None
fields_list = _key, firstTimeSeen, lastTimeSeen, instance_type, enough_data

[previously_seen_cloud_instance_modifications_by_user]
filename = None
default_match = None
case_sensitive_match = None
# description = A table of users seen making instance modifications, and the first and last time that the activity was observed
match_type = None
min_matches = None
fields_list = _key, firstTimeSeen, lastTimeSeen, user, enough_data

[previously_seen_cloud_provisioning_activity_sources]
filename = None
default_match = None
case_sensitive_match = None
# description = A table of source IPs, geographic locations, and the first and last time that they have that done cloud provisioning activities
match_type = None
min_matches = None
fields_list = _key, src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data

[previously_seen_cloud_regions]
filename = None
default_match = None
case_sensitive_match = None
# description = A table of vendor_region values and the first and last time that they have been observed in cloud provisioning activities
match_type = None
min_matches = None
fields_list = _key, firstTimeSeen, lastTimeSeen, vendor_region, enough_data

[previously_seen_cmd_line_arguments]
filename = previously_seen_cmd_line_arguments.csv
default_match = None
case_sensitive_match = None
# description = A placeholder for a list of cmd line arugments that been seen before
match_type = None
min_matches = None
fields_list = None

[previously_seen_ec2_modifications_by_user]
filename = previously_seen_ec2_modifications_by_user.csv
default_match = None
case_sensitive_match = None
# description = A place holder for a list of AWS EC2 modifications done by each user
match_type = None
min_matches = None
fields_list = None

[previously_seen_gcp_storage_access_from_remote_ip]
filename = previously_seen_gcp_storage_access_from_remote_ip.csv
default_match = false
case_sensitive_match = None
# description = A place holder for a list of GCP storage access from remote IPs
match_type = None
min_matches = 1
fields_list = None

[previously_seen_running_windows_services]
filename = None
default_match = None
case_sensitive_match = None
# description = A placeholder for the list of Windows Services running
match_type = None
min_matches = None
fields_list = _key, service, firstTimeSeen, lastTimeSeen

[previously_seen_users_console_logins]
filename = None
default_match = None
case_sensitive_match = None
# description = A table of users seen doing console logins, and the first and last time that the activity was observed
match_type = None
min_matches = None
fields_list = _key, firstTime, lastTime, user, src, City, Region, Country

[prohibited_apps_launching_cmd]
filename = prohibited_apps_launching_cmd.csv
default_match = None
case_sensitive_match = None
# description = A list of processes that should not be launching cmd.exe
match_type = WILDCARD(prohibited_applications)
min_matches = None
fields_list = None

[prohibited_processes]
filename = prohibited_processes.csv
default_match = None
case_sensitive_match = None
# description = A list of processes that have been marked as prohibited
match_type = None
min_matches = None
fields_list = None

[prohibited_softwares]
filename = prohibited_softwares.csv
default_match = None
case_sensitive_match = None
# description = A list of processes that have been marked as prohibited
match_type = None
min_matches = None
fields_list = None

[ransomware_extensions_lookup]
filename = ransomware_extensions.csv
default_match = false
case_sensitive_match = false
# description = A list of file extensions that are associated with ransomware
match_type = WILDCARD(Extensions)
min_matches = 1
fields_list = None

[ransomware_notes_lookup]
filename = ransomware_notes.csv
default_match = false
case_sensitive_match = None
# description = A list of file names that are ransomware note files
match_type = WILDCARD(ransomware_notes)
min_matches = 1
fields_list = None

[s3_deletion_baseline]
filename = s3_deletion_baseline.csv
default_match = None
case_sensitive_match = None
# description = A placeholder for the baseline information for AWS S3 deletions
match_type = None
min_matches = None
fields_list = None

[security_group_activity_baseline]
filename = security_group_activity_baseline.csv
default_match = None
case_sensitive_match = None
# description = A placeholder for the baseline information for AWS security groups
match_type = None
min_matches = None
fields_list = None

[security_services_lookup]
filename = security_services.csv
default_match = false
case_sensitive_match = None
# description = A list of services that deal with security
match_type = WILDCARD(service)
min_matches = 1
fields_list = None

[suspicious_writes_lookup]
filename = suspicious_files.csv
default_match = false
case_sensitive_match = None
# description = A list of suspicious file names
match_type = WILDCARD(file)
min_matches = 1
fields_list = None

[zoom_first_time_child_process]
filename = None
default_match = None
case_sensitive_match = None
# description = A list of suspicious file names
match_type = None
min_matches = None
fields_list = _key, dest, process_name, firstTimeSeen, lastTimeSeen


### Default transforms definitions for the lookup files we ship ###
[mitre_enrichment]
filename = mitre_enrichment.csv
# description = A lookup file that is created by generate.py