############# # Automatically generated by generator.py in splunk/security_content # On Date: 2022-03-03T18:16:55 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# [aws_cloudwatchlogs_eks] definition = sourcetype="aws:cloudwatchlogs:eks" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [aws_config] definition = sourcetype=aws:config description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [aws_description] definition = sourcetype="aws:description" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [aws_ecr_users] definition = userName IN (user) description = specify the user allowed to push Images to AWS ECR. [aws_s3_accesslogs] definition = sourcetype=aws:s3:accesslogs description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [aws_securityhub_finding] definition = sourcetype="aws:securityhub:finding" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [aws_securityhub_firehose] definition = sourcetype="aws:securityhub:firehose" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [brand_abuse_dns] definition = lookup update=true brandMonitoring_lookup domain as query OUTPUT domain_abuse | search domain_abuse=true description = This macro limits the output to only domains that are in the brand monitoring lookup file [brand_abuse_email] definition = lookup update=true brandMonitoring_lookup domain as src_user OUTPUT domain_abuse | search domain_abuse=true description = This macro limits the output to only domains that are in the brand monitoring lookup file [brand_abuse_web] definition = lookup update=true brandMonitoring_lookup domain as urls OUTPUT domain_abuse | search domain_abuse=true description = This macro limits the output to only domains that are in the brand monitoring lookup file [circleci] definition = sourcetype=circleci description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [cisco_networks] definition = eventtype=cisco_ios description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [cloud_api_calls_from_previously_unseen_user_roles_activity_window] definition = "-70m@m" description = Use this macro to determine how far back you should be checking for new commands from user roles [cloudtrail] definition = sourcetype=aws:cloudtrail description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [cloudwatch_eks] definition = sourcetype="aws:cloudwatchlogs:eks" description = customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch eks logs. Replace the macro definition with configurations for your Splunk Environmnent. [cloudwatch_vpc] definition = sourcetype=aws:cloudwatchlogs:vpcflow description = customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch vpc logs. Replace the macro definition with configurations for your Splunk Environmnent. [cloudwatchlogs_vpcflow] definition = sourcetype=aws:cloudwatchlogs:vpcflow description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [dynamic_dns_providers] definition = lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True description = This macro limits the output of the query field to dynamic dns domains. It looks up the domains in a file provided by Splunk and one intended to be updated by the end user. [dynamic_dns_web_traffic] definition = lookup update=true dynamic_dns_providers_default dynamic_dns_domains as url OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as url OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True description = This is a description [ec2_modification_api_calls] definition = (eventName=AssociateAddress OR eventName=AssociateIamInstanceProfile OR eventName=AttachClassicLinkVpc OR eventName=AttachNetworkInterface OR eventName=AttachVolume OR eventName=BundleInstance OR eventName=DetachClassicLinkVpc OR eventName=DetachVolume OR eventName=ModifyInstanceAttribute OR eventName=ModifyInstancePlacement OR eventName=MonitorInstances OR eventName=RebootInstances OR eventName=ResetInstanceAttribute OR eventName=StartInstances OR eventName=StopInstances OR eventName=TerminateInstances OR eventName=UnmonitorInstances) description = This is a list of AWS event names that have to do with modifying Amazon EC2 instances [evilginx_phishlets_0365] definition = (query=login* AND query=www*) description = This limits the query fields to domains that are associated with evilginx masquerading as Office 365 [evilginx_phishlets_amazon] definition = (query=fls-na* AND query = www* AND query=images*) description = This limits the query fields to domains that are associated with evilginx masquerading as Amazon [evilginx_phishlets_aws] definition = (query=www* AND query=aws* AND query=console.aws* AND query=signin.aws* AND api-northeast-1.console.aws* AND query=fls-na* AND query=images-na*) description = This limits the query fields to domains that are associated with evilginx masquerading as an AWS console [evilginx_phishlets_facebook] definition = (query=www* AND query = m* AND query=static*) description = This limits the query fields to domains that are associated with evilginx masquerading as FaceBook [evilginx_phishlets_github] definition = (query=api* AND query = github*) description = This limits the query fields to domains that are associated with evilginx masquerading as GitHub [evilginx_phishlets_google] definition = (query=accounts* AND query=ssl* AND query=www*) description = This limits the query fields to domains that are associated with evilginx masquerading as Google [evilginx_phishlets_outlook] definition = (query=outlook* AND query=login* AND query=account*) description = This limits the query fields to domains that are associated with evilginx masquerading as Outlook [exchange] definition = sourcetype="MSWindows:IIS" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [f5_bigip_rogue] definition = index=netops sourcetype="f5:bigip:rogue" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [filter_rare_process_allow_list] definition = lookup update=true lookup_rare_process_allow_list_default process as process OUTPUTNEW allow_list | where allow_list="false" | lookup update=true lookup_rare_process_allow_list_local process as process OUTPUT allow_list | where allow_list="false" description = This macro is intended to allow_list processes that have been definied as rare [github] definition = sourcetype=aws:firehose:json description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [github_known_users] definition = user IN (user_names_here) description = specify the user allowed to create PRs in Github projects. [google_gcp_pubnet_message] definition = sourcetype="google:gcp:pubsub:message" description = customer specific splunk configurations(eg- index, source, sourcetype) for Google GCP. Replace the macro definition with configurations for your Splunk Environmnent. [google_gcp_pubsub_message] definition = sourcetype="google:gcp:pubsub:message" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [gsuite_calendar] definition = sourcetype=gsuite:calendar:json description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [gsuite_drive] definition = sourcetype=gsuite:drive:json description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [gsuite_gmail] definition = sourcetype=gsuite:gmail:bigquery description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [is_net_windows_file] definition = lookup update=true is_net_windows_file filename as process_name OUTPUT netFile | lookup update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile | search netFile=true description = This macro limits the output to process names that are .net binaries on Windows Server 2016 and Windows 11. [is_nirsoft_software] definition = lookup update=true is_nirsoft_software filename as process_name OUTPUT nirsoftFile | search nirsoftFile=true description = This macro is related to potentially identifiable software related to NirSoft. Remove or filter as needed based. [is_windows_system_file] definition = lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true description = This macro limits the output to process names that are in the Windows System directory [kube_objects_events] definition = sourcetype=kube:objects:events description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [kubernetes_azure] definition = sourcetype=mscs:storage:blob:json description = customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data from Azure. Replace the macro definition with configurations for your Splunk Environmnent. [kubernetes_container_controller] definition = sourcetype=kube:container:controller description = customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data. Replace the macro definition with configurations for your Splunk Environmnent. [linux_hosts] definition = index=* description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [linux_shells] definition = (Processes.process_name IN ("sh", "ksh", "zsh", "bash", "dash", "rbash", "fish", "csh', "tcsh', "ion", "eshell")) description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [netbackup] definition = sourcetype="netbackup_logs" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [network_acl_events] definition = (eventName = CreateNetworkAcl OR eventName = CreateNetworkAclEntry OR eventName = DeleteNetworkAcl OR eventName = DeleteNetworkAclEntry OR eventName = ReplaceNetworkAclEntry OR eventName = ReplaceNetworkAclAssociation) description = This is a list of AWS event names that are associated with Network ACLs [notable] definition = index=notable description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [o365_management_activity] definition = sourcetype=o365:management:activity description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [okta] definition = eventtype=okta_log description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [osquery_process] definition = eventtype="osquery-process" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [potentially_malicious_code_on_cmdline_tokenize_score] definition = eval orig_process=process, process=replace(lower(process), "`", "") | makemv tokenizer="([\w\d\-]+)" process | eval unusual_cmdline_feature_for=if(match(process, "^for$"), mvcount(mvfilter(match(process, "^for$"))), 0), unusual_cmdline_feature_netsh=if(match(process, "^netsh$"), mvcount(mvfilter(match(process, "^netsh$"))), 0), unusual_cmdline_feature_readbytes=if(match(process, "^readbytes$"), mvcount(mvfilter(match(process, "^readbytes$"))), 0), unusual_cmdline_feature_set=if(match(process, "^set$"), mvcount(mvfilter(match(process, "^set$"))), 0), unusual_cmdline_feature_unrestricted=if(match(process, "^unrestricted$"), mvcount(mvfilter(match(process, "^unrestricted$"))), 0), unusual_cmdline_feature_winstations=if(match(process, "^winstations$"), mvcount(mvfilter(match(process, "^winstations$"))), 0), unusual_cmdline_feature_-value=if(match(process, "^-value$"), mvcount(mvfilter(match(process, "^-value$"))), 0), unusual_cmdline_feature_compression=if(match(process, "^compression$"), mvcount(mvfilter(match(process, "^compression$"))), 0), unusual_cmdline_feature_server=if(match(process, "^server$"), mvcount(mvfilter(match(process, "^server$"))), 0), unusual_cmdline_feature_set-mppreference=if(match(process, "^set-mppreference$"), mvcount(mvfilter(match(process, "^set-mppreference$"))), 0), unusual_cmdline_feature_terminal=if(match(process, "^terminal$"), mvcount(mvfilter(match(process, "^terminal$"))), 0), unusual_cmdline_feature_-name=if(match(process, "^-name$"), mvcount(mvfilter(match(process, "^-name$"))), 0), unusual_cmdline_feature_catch=if(match(process, "^catch$"), mvcount(mvfilter(match(process, "^catch$"))), 0), unusual_cmdline_feature_get-wmiobject=if(match(process, "^get-wmiobject$"), mvcount(mvfilter(match(process, "^get-wmiobject$"))), 0), unusual_cmdline_feature_hklm=if(match(process, "^hklm$"), mvcount(mvfilter(match(process, "^hklm$"))), 0), unusual_cmdline_feature_streamreader=if(match(process, "^streamreader$"), mvcount(mvfilter(match(process, "^streamreader$"))), 0), unusual_cmdline_feature_system32=if(match(process, "^system32$"), mvcount(mvfilter(match(process, "^system32$"))), 0), unusual_cmdline_feature_username=if(match(process, "^username$"), mvcount(mvfilter(match(process, "^username$"))), 0), unusual_cmdline_feature_webrequest=if(match(process, "^webrequest$"), mvcount(mvfilter(match(process, "^webrequest$"))), 0), unusual_cmdline_feature_count=if(match(process, "^count$"), mvcount(mvfilter(match(process, "^count$"))), 0), unusual_cmdline_feature_webclient=if(match(process, "^webclient$"), mvcount(mvfilter(match(process, "^webclient$"))), 0), unusual_cmdline_feature_writeallbytes=if(match(process, "^writeallbytes$"), mvcount(mvfilter(match(process, "^writeallbytes$"))), 0), unusual_cmdline_feature_convert=if(match(process, "^convert$"), mvcount(mvfilter(match(process, "^convert$"))), 0), unusual_cmdline_feature_create=if(match(process, "^create$"), mvcount(mvfilter(match(process, "^create$"))), 0), unusual_cmdline_feature_function=if(match(process, "^function$"), mvcount(mvfilter(match(process, "^function$"))), 0), unusual_cmdline_feature_net=if(match(process, "^net$"), mvcount(mvfilter(match(process, "^net$"))), 0), unusual_cmdline_feature_com=if(match(process, "^com$"), mvcount(mvfilter(match(process, "^com$"))), 0), unusual_cmdline_feature_http=if(match(process, "^http$"), mvcount(mvfilter(match(process, "^http$"))), 0), unusual_cmdline_feature_io=if(match(process, "^io$"), mvcount(mvfilter(match(process, "^io$"))), 0), unusual_cmdline_feature_system=if(match(process, "^system$"), mvcount(mvfilter(match(process, "^system$"))), 0), unusual_cmdline_feature_new-object=if(match(process, "^new-object$"), mvcount(mvfilter(match(process, "^new-object$"))), 0), unusual_cmdline_feature_if=if(match(process, "^if$"), mvcount(mvfilter(match(process, "^if$"))), 0), unusual_cmdline_feature_threading=if(match(process, "^threading$"), mvcount(mvfilter(match(process, "^threading$"))), 0), unusual_cmdline_feature_mutex=if(match(process, "^mutex$"), mvcount(mvfilter(match(process, "^mutex$"))), 0), unusual_cmdline_feature_cryptography=if(match(process, "^cryptography$"), mvcount(mvfilter(match(process, "^cryptography$"))), 0), unusual_cmdline_feature_computehash=if(match(process, "^computehash$"), mvcount(mvfilter(match(process, "^computehash$"))), 0) description = Performs the tokenization and application of the malicious commandline classifier [powershell] definition = (source=WinEventLog:Microsoft-Windows-PowerShell/Operational OR source="XmlWinEventLog:Microsoft-Windows-PowerShell/Operational") description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [previously_seen_cloud_api_calls_per_user_role_forget_window] definition = "-90d@d" description = Use this macro to determine how long to keep track of cloud api calls per user role [previously_seen_cloud_compute_creations_by_user_search_window_begin_offset] definition = "-70m@m" description = Use this macro to determine how far into the past the window should be to determine if the user is new or not [previously_seen_cloud_compute_image_search_window_begin_offset] definition = "-70m@m" description = Use this macro to determine how far into the past the window should be to determine if the image is new or not [previously_seen_cloud_compute_images_forget_window] definition = "-90d@d" description = Use this macro to determine how long to keep track of cloud instance images [previously_seen_cloud_compute_instance_type_forget_window] definition = "-90d@d" description = Use this macro to determine how long to keep track of cloud instance types [previously_seen_cloud_compute_instance_types_search_window_begin_offset] definition = "-70m@m" description = Use this macro to determine how far into the past the window should be to determine if the instance type is new or not [previously_seen_cloud_instance_modifications_by_user_search_window_begin_offset] definition = "-70m@m" description = Use this macro to determine how far into the past the window should be to determine if the user is new or not [previously_seen_cloud_provisioning_activity_forget_window] definition = "-90d@d" description = Use this macro to determine how long to keep track of cloud provisioning locations [previously_seen_cloud_region_forget_window] definition = "-90d@d" description = Use this macro to determine how long to keep track of cloud regions [previously_seen_cloud_regions_search_window_begin_offset] definition = "-70m@m" description = Use this macro to determine how far into the past the window should be to determine if the region is new or not [previously_seen_windows_services_forget_window] definition = "-90d@d" description = Use this macro to determine how long to keep track of Windows services [previously_seen_windows_services_window] definition = "-70m@m" description = Use this macro to determine how far back you should be checking for new Windows services [previously_seen_zoom_child_processes_forget_window] definition = "-90d@d" description = Use this macro to determine how long to keep track of zoom child processes [previously_seen_zoom_child_processes_window] definition = "-70m@m" description = Use this macro to determine how far back you should be checking for new zoom child processes [previously_unseen_cloud_provisioning_activity_window] definition = "-70m@m" description = Use this macro to determine how far back you should be checking for new provisioning activities [printservice] definition = source="wineventlog:microsoft-windows-printservice/operational" OR sourcetype="WinEventLog:Microsoft-Windows-PrintService/Admin" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [process_bitsadmin] definition = (Processes.process_name=bitsadmin.exe OR Processes.original_file_name=bitsadmin.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_certutil] definition = (Processes.process_name=certutil.exe OR Processes.original_file_name=CertUtil.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_cmd] definition = (Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_copy] definition = (Processes.process_name=copy.exe OR Processes.original_file_name=copy.exe OR Processes.process_name=xcopy.exe OR Processes.original_file_name=xcopy.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_csc] definition = (Processes.process_name=csc.exe OR Processes.original_file_name=csc.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_curl] definition = (Processes.process_name=curl.exe OR Processes.original_file_name=Curl.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_diskshadow] definition = (Processes.process_name=diskshadow.exe OR Processes.original_file_name=diskshadow.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_dllhost] definition = (Processes.process_name=dllhost.exe OR Processes.original_file_name=dllhost.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_dsquery] definition = (Processes.process_name=dsquery.exe OR Processes.original_file_name=dsquery.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_dxdiag] definition = (Processes.process_name=dxdiag.exe OR Processes.original_file_name=dxdiag.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_esentutl] definition = (Processes.process_name=esentutl.exe OR Processes.original_file_name=esentutl.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_fodhelper] definition = (Processes.process_name=fodhelper.exe OR Processes.original_file_name=FodHelper.EXE) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_gpupdate] definition = (Processes.process_name=gpupdate.exe OR Processes.original_file_name=GPUpdate.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_hh] definition = (Processes.process_name=hh.exe OR Processes.original_file_name=HH.EXE) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_installutil] definition = (Processes.process_name=installutil.exe OR Processes.original_file_name=InstallUtil.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_microsoftworkflowcompiler] definition = (Processes.process_name=microsoft.workflow.compiler.exe OR Processes.original_file_name=Microsoft.Workflow.Compiler.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_msbuild] definition = (Processes.process_name=msbuild.exe OR Processes.original_file_name=MSBuild.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_mshta] definition = (Processes.process_name=mshta.exe OR Processes.original_file_name=MSHTA.EXE) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_net] definition = (Processes.process_name="net.exe" OR Processes.original_file_name="net.exe" OR Processes.process_name="net1.exe" OR Processes.original_file_name="net1.exe") description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_netsh] definition = (Processes.process_name=netsh.exe OR Processes.original_file_name=netsh.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_nltest] definition = (Processes.process_name=nltest.exe OR Processes.original_file_name=nltestrk.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_ntdsutil] definition = (Processes.process_name=ntdsutil.exe OR Processes.original_file_name=ntdsutil.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_ping] definition = (Processes.process_name=ping.exe OR Processes.original_file_name=ping.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_powershell] definition = (Processes.process_name=pwsh.exe OR Processes.process_name=sqlps.exe OR Processes.process_name=sqltoolsps.exe OR Processes.process_name=powershell.exe OR Processes.process_name=powershell_ise.exe OR Processes.original_file_name=pwsh.dll OR Processes.original_file_name=PowerShell.EXE OR Processes.original_file_name=powershell_ise.EXE) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_procdump] definition = (Processes.process_name=procdump.exe OR Processes.process_name=procdump64.exe OR Processes.original_file_name=procdump) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_psexec] definition = (Processes.process_name=psexec.exe OR Processes.process_name=psexec64.exe OR Processes.original_file_name=psexec.c) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_rclone] definition = (Processes.original_file_name=rclone.exe OR Processes.process_name=rclone.exe) description = Matches the process with its original file name. [process_reg] definition = (Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_regasm] definition = (Processes.process_name=regasm.exe OR Processes.original_file_name=RegAsm.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_regsvcs] definition = (Processes.process_name=regsvcs.exe OR Processes.original_file_name=RegSvcs.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_regsvr32] definition = (Processes.process_name=regsvr32.exe OR Processes.original_file_name=REGSVR32.EXE) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_route] definition = (Processes.process_name=route.exe OR Processes.original_file_name=route.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_runas] definition = (Processes.process_name=runas.exe OR Processes.original_file_name=runas.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_rundll32] definition = (Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_schtasks] definition = (Processes.process_name=schtasks.exe OR Processes.original_file_name=schtasks.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_sdelete] definition = (Processes.process_name=sdelete.exe OR Processes.original_file_name=sdelete.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_setspn] definition = (Processes.process_name=setspn.exe OR Processes.original_file_name=setspn.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_verclsid] definition = (Processes.process_name=verclsid.exe OR Processes.original_file_name=verclsid.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_vssadmin] definition = (Processes.process_name=vssadmin.exe OR Processes.original_file_name=VSSADMIN.EXE) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_wbadmin] definition = (Processes.process_name=wbadmin.exe OR Processes.original_file_name=WBADMIN.EXE) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [process_wmic] definition = (Processes.process_name=wmic.exe OR Processes.original_file_name=wmic.exe) description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/ [prohibited_apps_launching_cmd] definition = | inputlookup prohibited_apps_launching_cmd | rename prohibited_applications as parent_process_name | eval parent_process_name="*" . parent_process_name | table parent_process_name description = This macro outputs a list of process that should not be the parent process of cmd.exe [prohibited_softwares] definition = lookup prohibited_softwares app as process_name OUTPUT is_prohibited | search is_prohibited=True description = This macro limits the output to process_names that have been marked as prohibited [ransomware_extensions] definition = lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Name | search Name !=False description = This macro limits the output to files that have extensions associated with ransomware [ransomware_notes] definition = lookup ransomware_notes_lookup ransomware_notes as file_name OUTPUT status as "Known Ransomware Notes" | search "Known Ransomware Notes"=True description = This macro limits the output to files that have been identified as a ransomware note [remove_valid_domains] definition = eval domain=trim(domain,"*") | search NOT[| inputlookup domains] NOT[ |inputlookup cim_corporate_email_domain_lookup] NOT[inputlookup cim_corporate_web_domain_lookup] | eval domain="*"+domain+"*" description = This macro removes valid domains from the output [s3_accesslogs] definition = sourcetype=aws:s3:accesslogs description = customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch vpc logs. Replace the macro definition with configurations for your Splunk Environmnent. [security_content_ctime(1)] args = field definition = convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$) description = convert epoch time to string [security_content_summariesonly] definition = summariesonly=false allow_old_summaries=true description = search data model's summaries only [security_group_api_calls] definition = (eventName=AuthorizeSecurityGroupIngress OR eventName=CreateSecurityGroup OR eventName=DeleteSecurityGroup OR eventName=DescribeClusterSecurityGroups OR eventName=DescribeDBSecurityGroups OR eventName=DescribeSecurityGroupReferences OR eventName=DescribeSecurityGroups OR eventName=DescribeStaleSecurityGroups OR eventName=RevokeSecurityGroupIngress OR eventName=UpdateSecurityGroupRuleDescriptionsIngress) description = This macro is a list of AWS event names associated with security groups [signals] definition = index=signals description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [stream_dns] definition = sourcetype=stream:dns description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [stream_http] definition = sourcetype=stream:http description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [stream_tcp] definition = sourcetype=stream:tcp description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [suspicious_email_attachments] definition = lookup update=true is_suspicious_file_extension_lookup file_name OUTPUT suspicious | search suspicious=true description = This macro limits the output to email attachments that have suspicious extensions [suspicious_writes] definition = lookup suspicious_writes_lookup file as file_name OUTPUT note as "Reference" | search "Reference" != False description = This macro limites the output to file names that have been marked as suspicious [sysmon] definition = sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=Syslog:Linux-Sysmon/Operational description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [system_network_configuration_discovery_tools] definition = (process_name= "arp.exe" OR process_name= "at.exe" OR process_name= "attrib.exe" OR process_name= "cscript.exe" OR process_name= "dsquery.exe" OR process_name= "hostname.exe" OR process_name= "ipconfig.exe" OR process_name= "mimikatz.exe" OR process_name= "nbstat.exe" OR process_name= "net.exe" OR process_name= "netsh.exe" OR process_name= "nslookup.exe" OR process_name= "ping.exe" OR process_name= "quser.exe" OR process_name= "qwinsta.exe" OR process_name= "reg.exe" OR process_name= "runas.exe" OR process_name= "sc.exe" OR process_name= "schtasks.exe" OR process_name= "ssh.exe" OR process_name= "systeminfo.exe" OR process_name= "taskkill.exe" OR process_name= "telnet.exe" OR process_name= "tracert.exe" OR process_name="wscript.exe" OR process_name= "xcopy.exe") description = This macro is a list of process that can be used to discover the network configuration [uncommon_processes] definition = lookup update=true lookup_uncommon_processes_default process_name as process_name outputnew uncommon_default,category_default,analytic_story_default,kill_chain_phase_default,mitre_attack_default | lookup update=true lookup_uncommon_processes_local process_name as process_name outputnew uncommon_local,category_local,analytic_story_local,kill_chain_phase_local,mitre_attack_local | eval uncommon = coalesce(uncommon_default, uncommon_local), analytic_story = coalesce(analytic_story_default, analytic_story_local), category=coalesce(category_default, category_local), kill_chain_phase=coalesce(kill_chain_phase_default, kill_chain_phase_local), mitre_attack=coalesce(mitre_attack_default, mitre_attack_local) | fields - analytic_story_default, analytic_story_local, category_default, category_local, kill_chain_phase_default, kill_chain_phase_local, mitre_attack_default, mitre_attack_local, uncommon_default, uncommon_local | search uncommon=true description = This macro limits the output to processes that have been marked as uncommon [windows_shells] definition = (Processes.process_name=cmd.exe OR Processes.process_name=powershell.exe) description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [wineventlog_security] definition = eventtype=wineventlog_security description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [wineventlog_system] definition = eventtype=wineventlog_system description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [wineventlog_task_scheduler] definition = source="WinEventLog:Microsoft-Windows-TaskScheduler/Operational" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [wmi] definition = sourcetype="wineventlog:microsoft-windows-wmi-activity/operational" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [zeek_rpc] definition = index=zeek sourcetype="zeek:rpc:json" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [zeek_ssl] definition = index=zeek sourcetype="zeek:ssl:json" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [7zip_commandline_to_smb_share_path_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_cloud_provisioning_from_previously_unseen_city_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_cloud_provisioning_from_previously_unseen_country_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_cloud_provisioning_from_previously_unseen_ip_address_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_cloud_provisioning_from_previously_unseen_region_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_create_policy_version_to_allow_all_resources_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_createaccesskey_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_createloginprofile_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_cross_account_activity_from_previously_unseen_account_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_detect_users_with_kms_keys_performing_encryption_s3_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_ecr_container_scanning_findings_high_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_ecr_container_scanning_findings_low_informational_unknown_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_ecr_container_scanning_findings_medium_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_ecr_container_upload_outside_business_hours_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_ecr_container_upload_unknown_user_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_eks_kubernetes_cluster_sensitive_object_access_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_excessive_security_scanning_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_iam_accessdenied_discovery_events_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_iam_assume_role_policy_brute_force_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_iam_delete_policy_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_iam_failure_group_deletion_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_iam_successful_group_deletion_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_investigate_security_hub_alerts_by_dest_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_investigate_user_activities_by_arn_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_investigate_user_activities_by_accesskeyid_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_lambda_updatefunctioncode_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_network_acl_details_from_id_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_network_access_control_list_created_with_all_open_ports_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_network_access_control_list_deleted_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_network_interface_details_via_resourceid_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_s3_bucket_details_via_bucketname_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_saml_access_by_provider_user_and_principal_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_saml_update_identity_provider_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_setdefaultpolicyversion_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_updateloginprofile_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [abnormally_high_aws_instances_launched_by_user_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [abnormally_high_aws_instances_launched_by_user___mltk_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [abnormally_high_aws_instances_terminated_by_user_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [abnormally_high_aws_instances_terminated_by_user___mltk_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [abnormally_high_number_of_cloud_infrastructure_api_calls_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [abnormally_high_number_of_cloud_instances_destroyed_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [abnormally_high_number_of_cloud_instances_launched_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [abnormally_high_number_of_cloud_security_group_api_calls_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [access_lsass_memory_for_dump_creation_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [account_discovery_with_net_app_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [active_setup_registry_autostart_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [add_defaultuser_and_password_in_registry_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [add_prohibited_processes_to_enterprise_security_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [add_or_set_windows_defender_exclusion_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [adsisearcher_account_discovery_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [all_backup_logs_for_host_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [allow_file_and_printing_sharing_in_firewall_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [allow_inbound_traffic_by_firewall_rule_registry_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [allow_inbound_traffic_in_firewall_rule_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [allow_network_discovery_in_firewall_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [allow_operation_with_consent_admin_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [amazon_eks_kubernetes_pod_scan_detection_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [amazon_eks_kubernetes_activity_by_src_ip_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [amazon_eks_kubernetes_cluster_scan_detection_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [anomalous_usage_of_7zip_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [any_powershell_downloadfile_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [any_powershell_downloadstring_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [attacker_tools_on_endpoint_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [attempt_to_add_certificate_to_untrusted_store_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [attempt_to_stop_security_service_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [attempted_credential_dump_from_registry_via_reg_exe_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [auto_admin_logon_registry_entry_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [bcdedit_failure_recovery_modification_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [bits_job_persistence_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [bitsadmin_download_file_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [baseline_of_cloud_infrastructure_api_calls_per_user_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [baseline_of_cloud_instances_destroyed_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [baseline_of_cloud_instances_launched_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [baseline_of_cloud_security_group_api_calls_per_user_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [baseline_of_api_calls_per_user_arn_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [baseline_of_command_line_length___mltk_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [baseline_of_dns_query_length___mltk_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [baseline_of_excessive_aws_instances_launched_by_user___mltk_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [baseline_of_excessive_aws_instances_terminated_by_user___mltk_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [baseline_of_network_acl_activity_by_arn_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [baseline_of_s3_bucket_deletion_activity_by_arn_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [baseline_of_smb_traffic___mltk_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [baseline_of_security_group_activity_by_arn_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [baseline_of_blocked_outbound_traffic_from_aws_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [batch_file_write_to_system32_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [bcdedit_command_back_to_normal_mode_boot_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [chcp_command_execution_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [cmd_carry_out_string_command_parameter_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [cmd_echo_pipe___escalation_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [cmlua_or_cmstplua_uac_bypass_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [csc_net_on_the_fly_compilation_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [certutil_download_with_urlcache_and_split_arguments_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [certutil_download_with_verifyctl_and_split_arguments_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [certutil_with_decode_argument_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [certutil_exe_certificate_extraction_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [change_default_file_association_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [change_to_safe_mode_with_network_config_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [check_elevated_cmd_using_whoami_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [child_processes_of_spoolsv_exe_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [circle_ci_disable_security_job_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [circle_ci_disable_security_step_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [clear_unallocated_sector_using_cipher_app_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [clients_connecting_to_multiple_dns_servers_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [clop_common_exec_parameter_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [clop_ransomware_known_service_name_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [cloud_api_calls_from_previously_unseen_user_roles_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [cloud_compute_instance_created_by_previously_unseen_user_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [cloud_compute_instance_created_in_previously_unused_region_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [cloud_compute_instance_created_with_previously_unseen_image_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [cloud_compute_instance_created_with_previously_unseen_instance_type_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [cloud_instance_modified_by_previously_unseen_user_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [cloud_network_access_control_list_deleted_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [cloud_provisioning_activity_from_previously_unseen_city_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [cloud_provisioning_activity_from_previously_unseen_country_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [cloud_provisioning_activity_from_previously_unseen_ip_address_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [cloud_provisioning_activity_from_previously_unseen_region_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [cmdline_tool_not_executed_in_cmd_shell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [cobalt_strike_named_pipes_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [common_ransomware_extensions_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [common_ransomware_notes_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [conti_common_exec_parameter_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [control_loading_from_world_writable_directory_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [correlation_by_repository_and_risk_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [correlation_by_user_and_risk_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [count_of_unique_ips_connecting_to_ports_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [count_of_assets_by_category_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [create_remote_thread_in_shell_application_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [create_remote_thread_into_lsass_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [create_a_list_of_approved_aws_service_accounts_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [create_local_admin_accounts_using_net_exe_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [create_or_delete_windows_shares_using_net_exe_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [creation_of_shadow_copy_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [creation_of_shadow_copy_with_wmic_and_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [creation_of_lsass_dump_with_taskmgr_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [credential_dumping_via_copy_command_from_shadow_copy_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [credential_dumping_via_symlink_to_shadow_copy_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [curl_download_and_bash_execution_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [dllhost_with_no_command_line_arguments_with_network_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [dns_exfiltration_using_nslookup_app_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [dns_query_length_outliers___mltk_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [dns_query_length_with_high_standard_deviation_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [dns_query_requests_resolved_by_unauthorized_dns_servers_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [dns_record_changed_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [dnstwist_domain_names_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [dsquery_domain_discovery_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [delete_shadowcopy_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [deleting_of_net_users_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [deleting_shadow_copies_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_api_activity_from_users_without_mfa_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_arp_poisoning_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_aws_api_activities_from_unapproved_accounts_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_aws_console_login_by_new_user_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_aws_console_login_by_user_from_new_city_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_aws_console_login_by_user_from_new_country_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_aws_console_login_by_user_from_new_region_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_activity_related_to_pass_the_hash_attacks_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_azurehound_command_line_arguments_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_azurehound_file_modifications_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_baron_samedit_cve_2021_3156_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_baron_samedit_cve_2021_3156_segfault_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_baron_samedit_cve_2021_3156_via_osquery_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_computer_changed_with_anonymous_account_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_copy_of_shadowcopy_with_script_block_logging_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_credential_dumping_through_lsass_access_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_empire_with_powershell_script_block_logging_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_excessive_account_lockouts_from_endpoint_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_excessive_user_account_lockouts_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_exchange_web_shell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_f5_tmui_rce_cve_2020_5902_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_gcp_storage_access_from_a_new_ip_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_html_help_renamed_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_html_help_spawn_child_process_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_html_help_url_in_command_line_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_html_help_using_infotech_storage_handlers_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_ipv6_network_infrastructure_threats_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_large_outbound_icmp_packets_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_long_dns_txt_record_response_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_mshta_url_in_command_line_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_mimikatz_using_loaded_images_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_mimikatz_via_powershell_and_eventcode_4703_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_mimikatz_with_powershell_script_block_logging_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_new_local_admin_account_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_new_login_attempts_to_routers_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_new_open_gcp_storage_buckets_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_new_open_s3_buckets_over_aws_cli_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_new_open_s3_buckets_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_outbound_ldap_traffic_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_outbound_smb_traffic_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_outlook_exe_writing_a_zip_file_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_path_interception_by_creation_of_program_exe_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_port_security_violation_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_prohibited_applications_spawning_cmd_exe_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_psexec_with_accepteula_flag_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_rclone_command_line_usage_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_rare_executables_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_regasm_spawning_a_process_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_regasm_with_network_connection_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_regasm_with_no_command_line_arguments_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_regsvcs_spawning_a_process_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_regsvcs_with_network_connection_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_regsvcs_with_no_command_line_arguments_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_regsvr32_application_control_bypass_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_renamed_7_zip_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_renamed_psexec_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_renamed_rclone_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_renamed_winrar_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_rogue_dhcp_server_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_rundll32_application_control_bypass___advpack_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_rundll32_application_control_bypass___setupapi_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_rundll32_application_control_bypass___syssetup_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_rundll32_inline_hta_execution_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_s3_access_from_a_new_ip_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_snicat_sni_exfiltration_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_sharphound_command_line_arguments_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_sharphound_file_modifications_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_sharphound_usage_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_software_download_to_network_device_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_spike_in_aws_api_activity_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_spike_in_aws_security_hub_alerts_for_user_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_spike_in_network_acl_activity_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_spike_in_s3_bucket_deletion_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_spike_in_security_group_activity_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_spike_in_blocked_outbound_traffic_from_your_aws_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_traffic_mirroring_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_usb_device_insertion_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_unauthorized_assets_by_mac_address_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_use_of_cmd_exe_to_launch_script_interpreters_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_wmi_event_subscription_persistence_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_windows_dns_sigred_via_splunk_stream_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_windows_dns_sigred_via_zeek_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_zerologon_via_zeek_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_attackers_scanning_for_vulnerable_jboss_servers_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_hosts_connecting_to_dynamic_domain_providers_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_malicious_requests_to_exploit_jboss_servers_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_mshta_inline_hta_execution_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_mshta_renamed_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_new_api_calls_from_user_roles_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_new_user_aws_console_login_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_processes_used_for_system_network_configuration_discovery_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_shared_ec2_snapshot_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detect_web_traffic_to_dynamic_domain_providers_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detection_of_dns_tunnels_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [detection_of_tools_built_by_nirsoft_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disable_amsi_through_registry_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disable_defender_antivirus_registry_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disable_defender_blockatfirstseen_feature_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disable_defender_enhanced_notification_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disable_defender_mpengine_registry_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disable_defender_spynet_reporting_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disable_defender_submit_samples_consent_feature_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disable_etw_through_registry_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disable_logs_using_wevtutil_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disable_registry_tool_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disable_schedule_task_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disable_security_logs_using_minint_registry_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disable_show_hidden_files_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disable_uac_remote_restriction_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disable_windows_app_hotkeys_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disable_windows_behavior_monitoring_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disable_windows_smartscreen_protection_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disabled_kerberos_pre_authentication_discovery_with_powerview_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disabling_cmd_application_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disabling_controlpanel_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disabling_defender_services_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disabling_firewall_with_netsh_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disabling_folderoptions_windows_feature_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disabling_net_user_account_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disabling_norun_windows_app_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disabling_remote_user_account_control_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disabling_systemrestore_in_registry_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [disabling_task_manager_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [discover_dns_records_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [domain_account_discovery_with_net_app_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [domain_account_discovery_with_dsquery_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [domain_account_discovery_with_wmic_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [domain_controller_discovery_with_nltest_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [domain_controller_discovery_with_wmic_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [domain_group_discovery_with_dsquery_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [domain_group_discovery_with_net_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [domain_group_discovery_with_wmic_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [domain_group_discovery_with_adsisearcher_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [download_files_using_telegram_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [drop_icedid_license_dat_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [dump_lsass_via_comsvcs_dll_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [dump_lsass_via_procdump_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [dump_lsass_via_procdump_rename_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [ec2_instance_modified_with_previously_unseen_user_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [ec2_instance_started_in_previously_unseen_region_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [ec2_instance_started_with_previously_unseen_ami_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [ec2_instance_started_with_previously_unseen_instance_type_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [ec2_instance_started_with_previously_unseen_user_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [etw_registry_disabled_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [elevated_group_discovery_with_net_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [elevated_group_discovery_with_wmic_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [elevated_group_discovery_with_powerview_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [email_attachments_with_lots_of_spaces_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [email_files_written_outside_of_the_outlook_directory_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [email_servers_sending_high_volume_traffic_to_hosts_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [enable_rdp_in_other_port_number_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [enable_wdigest_uselogoncredential_registry_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [enumerate_users_local_group_using_telegram_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [esentutl_sam_copy_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [eventvwr_uac_bypass_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [excel_spawning_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [excel_spawning_windows_script_host_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [excessive_attempt_to_disable_services_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [excessive_dns_failures_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [excessive_file_deletion_in_windefender_folder_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [excessive_service_stop_attempt_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [excessive_usage_of_cacls_app_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [excessive_usage_of_net_app_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [excessive_usage_of_sc_service_utility_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [excessive_usage_of_taskkill_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [excessive_usage_of_nslookup_app_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [excessive_number_of_distinct_processes_created_in_windows_temp_folder_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [excessive_number_of_service_control_start_as_disabled_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [excessive_number_of_taskhost_processes_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [exchange_powershell_abuse_via_ssrf_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [exchange_powershell_module_usage_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [executable_file_written_in_administrative_smb_share_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [executables_or_script_creation_in_suspicious_path_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [execute_javascript_with_jscript_com_clsid_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [execution_of_file_with_spaces_before_extension_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [execution_of_file_with_multiple_extensions_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [extended_period_without_successful_netbackup_backups_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [extraction_of_registry_hives_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [file_with_samsam_extension_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [firewall_allowed_program_enable_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [first_time_seen_child_process_of_zoom_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [first_time_seen_running_windows_service_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [first_time_seen_command_line_argument_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [fodhelper_uac_bypass_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [fsutil_zeroing_file_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [gcp_detect_accounts_with_high_risk_roles_by_project_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [gcp_detect_gcploit_framework_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [gcp_detect_high_risk_permissions_by_resource_and_account_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [gcp_gcr_container_uploaded_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [gcp_kubernetes_activity_by_src_ip_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [gcp_kubernetes_cluster_pod_scan_detection_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [gcp_kubernetes_cluster_scan_detection_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [gpupdate_with_no_command_line_arguments_with_network_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [gsuite_email_suspicious_attachment_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [gdrive_suspicious_file_sharing_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_addefaultdomainpasswordpolicy_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_aduser_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_aduser_with_powershell_script_block_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_aduserresultantpasswordpolicy_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_aduserresultantpasswordpolicy_with_powershell_script_block_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_all_aws_activity_from_city_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_all_aws_activity_from_country_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_all_aws_activity_from_ip_address_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_all_aws_activity_from_region_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_backup_logs_for_endpoint_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_certificate_logs_for_a_domain_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_dns_server_history_for_a_host_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_dns_traffic_ratio_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_domainpolicy_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_domainpolicy_with_powershell_script_block_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_domainuser_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_domainuser_with_powershell_script_block_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_ec2_instance_details_by_instanceid_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_ec2_launch_details_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_email_info_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_emails_from_specific_sender_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_first_occurrence_and_last_occurrence_of_a_mac_address_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_history_of_email_sources_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_logon_rights_modifications_for_endpoint_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_logon_rights_modifications_for_user_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_notable_history_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_outbound_emails_to_hidden_cobra_threat_actors_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_parent_process_info_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_process_file_activity_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_process_info_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_process_information_for_port_activity_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_process_responsible_for_the_dns_traffic_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_sysmon_wmi_activity_for_host_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_wmiobject_group_discovery_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_wmiobject_group_discovery_with_script_block_logging_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_web_session_information_via_session_id_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_domaintrust_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_domaintrust_with_powershell_script_block_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_foresttrust_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [get_foresttrust_with_powershell_script_block_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getadcomputer_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getadcomputer_with_powershell_script_block_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getadgroup_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getadgroup_with_powershell_script_block_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getcurrent_user_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getcurrent_user_with_powershell_script_block_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getdomaincomputer_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getdomaincomputer_with_powershell_script_block_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getdomaincontroller_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getdomaincontroller_with_powershell_script_block_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getdomaingroup_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getdomaingroup_with_powershell_script_block_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getlocaluser_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getlocaluser_with_powershell_script_block_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getnettcpconnection_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getnettcpconnection_with_powershell_script_block_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getwmiobject_ds_user_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getwmiobject_ds_user_with_powershell_script_block_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getwmiobject_ds_computer_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getwmiobject_ds_computer_with_powershell_script_block_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getwmiobject_ds_group_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getwmiobject_ds_group_with_powershell_script_block_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getwmiobject_user_account_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [getwmiobject_user_account_with_powershell_script_block_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [github_dependabot_alert_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [github_pull_request_from_unknown_user_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [github_commit_changes_in_master_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [github_commit_in_develop_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [gsuite_drive_share_in_external_email_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [gsuite_email_suspicious_subject_with_attachment_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [gsuite_email_with_known_abuse_web_service_link_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [gsuite_outbound_email_with_attachment_to_external_domain_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [gsuite_suspicious_shared_file_name_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [gsuite_suspicious_calendar_invite_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [hide_user_account_from_sign_in_screen_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [hiding_files_and_directories_with_attrib_exe_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [high_frequency_copy_of_files_in_network_share_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [high_number_of_login_failures_from_a_single_source_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [high_process_termination_frequency_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [hosts_receiving_high_volume_of_network_traffic_from_email_server_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [hunting_for_log4shell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [icacls_grant_command_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [icacls_deny_command_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [icedid_exfiltrated_archived_file_creation_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [identify_new_user_accounts_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [identify_systems_creating_remote_desktop_traffic_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [identify_systems_receiving_remote_desktop_traffic_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [identify_systems_using_remote_desktop_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [impacket_lateral_movement_commandline_parameters_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [interactive_session_on_remote_endpoint_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [investigate_aws_user_activities_by_user_field_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [investigate_aws_activities_via_region_name_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [investigate_failed_logins_for_multiple_destinations_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [investigate_network_traffic_from_src_ip_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [investigate_okta_activity_by_ip_address_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [investigate_okta_activity_by_app_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [investigate_pass_the_hash_attempts_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [investigate_pass_the_ticket_attempts_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [investigate_previous_unseen_user_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [investigate_successful_remote_desktop_authentications_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [investigate_suspicious_strings_in_http_header_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [investigate_user_activities_in_okta_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [investigate_web_posts_from_src_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [java_class_file_download_by_java_user_agent_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [jscript_execution_using_cscript_app_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kerberoasting_spn_request_with_rc4_encryption_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kerberos_pre_authentication_flag_disabled_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [known_services_killed_by_ransomware_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kubernetes_aws_detect_rbac_authorization_by_account_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kubernetes_aws_detect_most_active_service_accounts_by_pod_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kubernetes_aws_detect_sensitive_role_access_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kubernetes_aws_detect_service_accounts_forbidden_failure_access_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kubernetes_aws_detect_suspicious_kubectl_calls_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kubernetes_azure_detect_rbac_authorization_by_account_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kubernetes_azure_detect_sensitive_object_access_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kubernetes_azure_detect_sensitive_role_access_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kubernetes_azure_detect_suspicious_kubectl_calls_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kubernetes_azure_pod_scan_fingerprint_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kubernetes_azure_scan_fingerprint_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kubernetes_gcp_detect_rbac_authorizations_by_account_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kubernetes_gcp_detect_sensitive_object_access_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kubernetes_gcp_detect_sensitive_role_access_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kubernetes_gcp_detect_service_accounts_forbidden_failure_access_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kubernetes_gcp_detect_suspicious_kubectl_calls_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kubernetes_nginx_ingress_lfi_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kubernetes_nginx_ingress_rfi_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [kubernetes_scanner_image_pulling_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [large_volume_of_dns_any_queries_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_add_files_in_known_crontab_directories_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_add_user_account_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_at_allow_config_file_creation_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_at_application_execution_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_change_file_owner_to_root_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_common_process_for_elevation_control_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_dd_file_overwrite_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_doas_conf_file_creation_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_doas_tool_execution_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_edit_cron_table_parameter_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_file_created_in_kernel_driver_directory_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_file_creation_in_init_boot_directory_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_file_creation_in_profile_directory_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_insert_kernel_module_using_insmod_utility_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_install_kernel_module_using_modprobe_utility_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_java_spawning_shell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_nopasswd_entry_in_sudoers_file_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_possible_access_or_modification_of_sshd_config_file_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_possible_access_to_credential_files_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_possible_access_to_sudoers_file_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_possible_append_command_to_at_allow_config_file_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_possible_append_command_to_profile_config_file_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_possible_cronjob_modification_with_editor_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_possible_ssh_key_file_creation_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_preload_hijack_library_calls_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_service_file_created_in_systemd_directory_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_service_restarted_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_service_started_or_enabled_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_setuid_using_chmod_utility_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_setuid_using_setcap_utility_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_sudo_or_su_execution_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_sudoers_tmp_file_creation_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_system_network_discovery_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_visudo_utility_execution_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [linux_pkexec_privilege_escalation_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [loading_of_dynwrapx_module_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [local_account_discovery_with_wmic_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [local_account_discovery_with_net_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [log4shell_cve_2021_44228_exploitation_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [log4shell_jndi_payload_injection_attempt_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [log4shell_jndi_payload_injection_with_outbound_connection_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [logon_script_event_trigger_execution_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [ms_scripting_process_loading_ldap_module_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [ms_scripting_process_loading_wmi_module_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [msbuild_suspicious_spawned_by_script_process_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [mshtml_module_load_in_office_product_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [msi_module_loaded_by_non_system_binary_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [macos___re_opened_applications_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [mailsniper_invoke_functions_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [malicious_inprocserver32_modification_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [malicious_powershell_process___encoded_command_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [malicious_powershell_process___execution_policy_bypass_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [malicious_powershell_process___multiple_suspicious_command_line_arguments_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [malicious_powershell_process_with_obfuscation_techniques_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [malicious_powershell_executed_as_a_service_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [microsoft_exchange_mailbox_replication_service_writing_active_server_pages_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [mimikatz_passtheticket_commandline_parameters_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [mmc_lolbas_execution_process_spawn_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [modification_of_wallpaper_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [modify_acl_permission_to_files_or_folder_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [monitor_dns_for_brand_abuse_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [monitor_email_for_brand_abuse_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [monitor_registry_keys_for_print_monitors_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [monitor_successful_backups_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [monitor_unsuccessful_backups_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [monitor_web_traffic_for_brand_abuse_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [mshta_spawning_rundll32_or_regsvr32_process_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [msmpeng_application_dll_side_loading_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [multiple_archive_files_http_post_traffic_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [multiple_users_attempting_to_authenticate_using_explicit_credentials_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [multiple_users_failing_to_authenticate_from_host_using_kerberos_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [multiple_users_failing_to_authenticate_from_host_using_ntlm_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [multiple_users_failing_to_authenticate_from_process_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [multiple_users_remotely_failing_to_authenticate_from_host_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [net_profiler_uac_bypass_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [nltest_domain_trust_discovery_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [net_localgroup_discovery_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [network_connection_discovery_with_arp_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [network_connection_discovery_with_net_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [network_connection_discovery_with_netstat_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [network_discovery_using_route_windows_app_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [new_container_uploaded_to_aws_ecr_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [nishang_powershelltcponeline_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [no_windows_updates_in_a_time_frame_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [non_chrome_process_accessing_chrome_default_dir_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [non_firefox_process_access_firefox_profile_dir_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [ntdsutil_export_ntds_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [o365_add_app_role_assignment_grant_user_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [o365_added_service_principal_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [o365_bypass_mfa_via_trusted_ip_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [o365_disable_mfa_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [o365_excessive_authentication_failures_alert_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [o365_excessive_sso_logon_errors_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [o365_new_federated_domain_added_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [o365_pst_export_alert_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [o365_suspicious_admin_email_forwarding_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [o365_suspicious_rights_delegation_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [o365_suspicious_user_email_forwarding_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [office_application_drop_executable_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [office_application_spawn_regsvr32_process_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [office_application_spawn_rundll32_process_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [office_document_creating_schedule_task_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [office_document_executing_macro_code_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [office_document_spawned_child_process_to_download_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [office_product_spawn_cmd_process_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [office_product_spawning_bitsadmin_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [office_product_spawning_certutil_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [office_product_spawning_mshta_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [office_product_spawning_rundll32_with_no_dll_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [office_product_spawning_wmic_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [office_product_writing_cab_or_inf_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [office_spawning_control_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [okta_account_lockout_events_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [okta_failed_sso_attempts_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [okta_user_logins_from_multiple_cities_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [open_redirect_in_splunk_web_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [osquery_pack___coldroot_detection_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [outbound_network_connection_from_java_using_default_ports_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [overwriting_accessibility_binaries_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [password_policy_discovery_with_net_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [permission_modification_using_takeown_app_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [petitpotam_network_share_access_request_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [petitpotam_suspicious_kerberos_tgt_request_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [ping_sleep_batch_command_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [plain_http_post_exfiltrated_data_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [possible_browser_pass_view_parameter_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [possible_lateral_movement_powershell_spawn_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [potentially_malicious_code_on_commandline_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [powershell___connect_to_internet_with_hidden_window_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [powershell_4104_hunting_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [powershell_domain_enumeration_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [powershell_get_localgroup_discovery_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [powershell_start_bitstransfer_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [powershell_creating_thread_mutex_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [powershell_disable_security_monitoring_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [powershell_enable_smb1protocol_feature_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [powershell_execute_com_object_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [powershell_fileless_process_injection_via_getprocaddress_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [powershell_fileless_script_contains_base64_encoded_content_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [powershell_get_localgroup_discovery_with_script_block_logging_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [powershell_processing_stream_of_data_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [powershell_remote_thread_to_known_windows_process_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [powershell_remove_windows_defender_directory_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [powershell_using_memory_as_backing_store_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [powershell_windows_defender_exclusion_commands_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [prevent_automatic_repair_mode_using_bcdedit_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_aws_cross_account_activity_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_aws_cross_account_activity___initial_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_aws_cross_account_activity___update_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_aws_provisioning_activity_sources_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_aws_regions_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_cloud_api_calls_per_user_role___initial_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_cloud_api_calls_per_user_role___update_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_cloud_compute_creations_by_user___initial_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_cloud_compute_creations_by_user___update_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_cloud_compute_images___initial_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_cloud_compute_images___update_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_cloud_compute_instance_types___initial_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_cloud_compute_instance_types___update_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_cloud_instance_modifications_by_user___initial_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_cloud_instance_modifications_by_user___update_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_cloud_provisioning_activity_sources___initial_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_cloud_provisioning_activity_sources___update_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_cloud_regions___initial_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_cloud_regions___update_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_ec2_amis_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_ec2_instance_types_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_ec2_launches_by_user_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_ec2_modifications_by_user_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_running_windows_services___initial_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_running_windows_services___update_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_users_in_cloudtrail___update_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_users_in_cloudtrail___initial_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_zoom_child_processes___initial_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_zoom_child_processes___update_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_api_call_per_user_roles_in_cloudtrail_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_s3_bucket_access_by_remote_ip_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_command_line_arguments_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [previously_seen_users_in_cloudtrail_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [print_processor_registry_autostart_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [print_spooler_adding_a_printer_driver_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [print_spooler_failed_to_load_a_plug_in_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [process_creating_lnk_file_in_suspicious_location_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [process_deleting_its_process_file_path_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [process_execution_via_wmi_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [process_kill_base_on_file_path_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [process_writing_dynamicwrapperx_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [processes_tapping_keyboard_events_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [processes_created_by_netsh_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [processes_launching_netsh_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [prohibited_network_traffic_allowed_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [prohibited_software_on_endpoint_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [protocol_or_port_mismatch_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [protocols_passing_authentication_in_cleartext_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [randomly_generated_scheduled_task_name_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [randomly_generated_windows_service_name_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [ransomware_notes_bulk_creation_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [recon_avproduct_through_pwh_or_wmi_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [recon_using_wmi_class_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [recursive_delete_of_directory_in_batch_cmd_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [reg_exe_manipulating_windows_services_registry_keys_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [reg_exe_used_to_hide_files_directories_via_registry_keys_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [registry_keys_used_for_persistence_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [registry_keys_used_for_privilege_escalation_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [registry_keys_for_creating_shim_databases_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [regsvr32_silent_and_install_param_dll_loading_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [regsvr32_with_known_silent_switch_cmdline_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [remcos_rat_file_creation_in_remcos_folder_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [remcos_client_registry_install_entry_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [remote_desktop_network_bruteforce_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [remote_desktop_network_traffic_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [remote_desktop_process_running_on_system_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [remote_process_instantiation_via_dcom_and_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [remote_process_instantiation_via_dcom_and_powershell_script_block_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [remote_process_instantiation_via_wmi_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [remote_process_instantiation_via_wmi_and_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [remote_process_instantiation_via_wmi_and_powershell_script_block_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [remote_process_instantiation_via_winrm_and_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [remote_process_instantiation_via_winrm_and_powershell_script_block_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [remote_process_instantiation_via_winrm_and_winrs_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [remote_registry_key_modifications_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [remote_system_discovery_with_adsisearcher_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [remote_system_discovery_with_dsquery_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [remote_system_discovery_with_net_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [remote_system_discovery_with_wmic_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [remote_wmi_command_attempt_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [resize_shadowstorage_volume_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [revil_common_exec_parameter_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [revil_registry_entry_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [rubeus_command_line_parameters_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [rubeus_kerberos_ticket_exports_through_winlogon_access_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [rundll_loading_dll_by_ordinal_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [runas_execution_in_commandline_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [rundll32_control_rundll_hunt_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [rundll32_control_rundll_world_writable_directory_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [rundll32_create_remote_thread_to_a_process_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [rundll32_createremotethread_in_browser_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [rundll32_dnsquery_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [rundll32_lockworkstation_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [rundll32_process_creating_exe_dll_files_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [rundll32_shimcache_flush_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [rundll32_with_no_command_line_arguments_with_network_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [ryuk_test_files_detected_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [ryuk_wake_on_lan_command_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [sam_database_file_access_attempt_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [slui_runas_elevated_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [slui_spawning_a_process_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [smb_traffic_spike_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [smb_traffic_spike___mltk_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [sql_injection_with_long_urls_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [samsam_test_file_write_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [sc_exe_manipulating_windows_services_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [schcache_change_by_app_connect_and_create_adsi_object_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [schedule_task_with_http_command_arguments_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [schedule_task_with_rundll32_command_trigger_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [scheduled_task_creation_on_remote_endpoint_using_at_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [scheduled_task_deleted_or_created_via_cmd_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [scheduled_task_initiation_on_remote_endpoint_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [scheduled_tasks_used_in_badrabbit_ransomware_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [schtasks_run_task_on_demand_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [schtasks_scheduling_job_on_remote_system_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [schtasks_used_for_forcing_a_reboot_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [screensaver_event_trigger_execution_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [script_execution_via_wmi_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [sdclt_uac_bypass_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [sdelete_application_execution_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [searchprotocolhost_with_no_command_line_with_network_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [secretdumps_offline_ntds_dumping_tool_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [serviceprincipalnames_discovery_with_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [serviceprincipalnames_discovery_with_setspn_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [services_escalate_exe_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [services_lolbas_execution_process_spawn_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [shim_database_file_creation_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [shim_database_installation_with_suspicious_parameters_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [short_lived_scheduled_task_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [short_lived_windows_accounts_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [silentcleanup_uac_bypass_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [single_letter_process_on_endpoint_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [spectre_and_meltdown_vulnerable_systems_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [spike_in_file_writes_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [splunk_enterprise_information_disclosure_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [spoolsv_spawning_rundll32_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [spoolsv_suspicious_loaded_modules_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [spoolsv_suspicious_process_access_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [spoolsv_writing_a_dll_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [spoolsv_writing_a_dll___sysmon_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [sqlite_module_in_temp_folder_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [start_up_during_safe_mode_boot_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [sunburst_correlation_dll_and_network_event_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [supernova_webshell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_changes_to_file_associations_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_computer_account_name_change_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_copy_on_system32_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_curl_network_connection_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_dllhost_no_command_line_arguments_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_driver_loaded_path_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_email___uba_anomaly_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_email_attachment_extensions_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_event_log_service_behavior_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_file_write_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_gpupdate_no_command_line_arguments_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_icedid_rundll32_cmdline_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_image_creation_in_appdata_folder_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_java_classes_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_kerberos_service_ticket_request_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_linux_discovery_commands_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_msbuild_rename_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_msbuild_spawn_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_plistbuddy_usage_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_plistbuddy_usage_via_osquery_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_process_dns_query_known_abuse_web_services_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_process_file_path_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_process_with_discord_dns_query_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_reg_exe_process_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_regsvr32_register_suspicious_path_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_rundll32_plugininit_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_rundll32_rename_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_rundll32_startw_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_rundll32_dllregisterserver_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_rundll32_no_command_line_arguments_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_sqlite3_lsquarantine_behavior_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_scheduled_task_from_public_directory_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_searchprotocolhost_no_command_line_arguments_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_ticket_granting_ticket_request_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_wav_file_in_appdata_folder_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_microsoft_workflow_compiler_rename_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_microsoft_workflow_compiler_usage_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_msbuild_path_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_mshta_child_process_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_mshta_spawn_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_wevtutil_usage_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_writes_to_system_volume_information_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [suspicious_writes_to_windows_recycle_bin_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [svchost_lolbas_execution_process_spawn_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [system_info_gathering_using_dxdiag_application_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [system_information_discovery_detection_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [system_processes_run_from_unexpected_locations_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [system_user_discovery_with_query_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [system_user_discovery_with_whoami_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [systems_ready_for_spectre_meltdown_windows_patch_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [tor_traffic_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [time_provider_persistence_registry_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [trickbot_named_pipe_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [uac_bypass_mmc_load_unsigned_dll_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [uac_bypass_with_colorui_com_object_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [usn_journal_deletion_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [uncommon_processes_on_endpoint_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [unified_messaging_service_spawning_a_process_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [uninstall_app_using_msiexec_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [unload_sysmon_filter_driver_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [unloading_amsi_via_reflection_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [unsigned_image_loaded_by_lsass_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [unsuccessful_netbackup_backups_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [unusual_number_of_computer_service_tickets_requested_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [unusual_number_of_kerberos_service_tickets_requested_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [unusual_number_of_remote_endpoint_authentication_events_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [unusually_long_command_line_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [unusually_long_command_line___mltk_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [unusually_long_content_type_length_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [update_previously_seen_users_in_cloudtrail_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [user_discovery_with_env_vars_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [user_discovery_with_env_vars_powershell_script_block_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [vbscript_execution_using_wscript_app_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [verclsid_clsid_execution_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [w3wp_spawning_shell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [wbadmin_delete_system_backups_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [wmi_permanent_event_subscription_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [wmi_permanent_event_subscription___sysmon_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [wmi_recon_running_process_or_services_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [wmi_temporary_event_subscription_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [wmic_xsl_execution_via_url_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [wsreset_uac_bypass_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [wbemprox_com_object_execution_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [web_fraud___account_harvesting_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [web_fraud___anomalous_user_clickspeed_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [web_fraud___password_sharing_across_accounts_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [web_servers_executing_suspicious_processes_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [wermgr_process_connecting_to_ip_check_web_services_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [wermgr_process_create_executable_file_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [wermgr_process_spawned_cmd_or_powershell_process_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [wget_download_and_bash_execution_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [winevent_scheduled_task_created_within_public_path_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [winevent_scheduled_task_created_to_spawn_shell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [winevent_windows_task_scheduler_event_action_started_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [winrm_spawning_a_process_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_adfind_exe_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_curl_download_to_suspicious_path_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_curl_upload_to_remote_destination_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_dism_remove_defender_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_defender_exclusion_registry_entry_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_disable_memory_crash_dump_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_disableantispyware_registry_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_diskcryptor_usage_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_diskshadow_proxy_execution_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_dotnet_binary_in_non_standard_path_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_event_for_service_disabled_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_event_log_cleared_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_excessive_disabled_services_event_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_file_without_extension_in_critical_folder_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_high_file_deletion_frequency_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_hunting_system_account_targeting_lsass_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_installutil_credential_theft_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_installutil_remote_network_connection_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_installutil_url_in_command_line_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_installutil_uninstall_option_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_installutil_uninstall_option_with_network_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_installutil_in_non_standard_path_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_java_spawning_shells_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_modify_show_compress_color_and_info_tip_registry_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_nirsoft_advancedrun_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_nirsoft_utilities_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_non_system_account_targeting_lsass_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_possible_credential_dumping_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_process_with_namedpipe_commandline_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_raccine_scheduled_task_deletion_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_rasautou_dll_execution_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_raw_access_to_disk_volume_partition_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_raw_access_to_master_boot_record_drive_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_remote_assistance_spawning_process_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_schtasks_create_run_as_system_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_security_account_manager_stopped_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_service_created_with_suspicious_service_path_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_service_created_within_public_path_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_service_creation_using_registry_entry_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_service_creation_on_remote_endpoint_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_service_initiation_on_remote_endpoint_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_updates_install_failures_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_updates_install_successes_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_wmi_process_call_create_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_connhost_exe_started_forcefully_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [windows_hosts_file_modification_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [winhlp32_spawning_a_process_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [winword_spawning_cmd_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [winword_spawning_powershell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [winword_spawning_windows_script_host_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [wmic_group_discovery_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [wmic_noninteractive_app_uninstallation_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [wmiprsve_lolbas_execution_process_spawn_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [wscript_or_cscript_suspicious_child_process_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [wsmprovhost_lolbas_execution_process_spawn_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [xmrig_driver_loaded_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [xsl_script_execution_with_wmic_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_detect_attach_to_role_policy_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_detect_permanent_key_creation_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_detect_role_creation_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_detect_sts_assume_role_abuse_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [aws_detect_sts_get_session_token_abuse_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. [gcp_detect_oauth_token_abuse_filter] definition = search * description = Update this macro to limit the output results to filter out false positives.