mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
research bot
224 lines
4.0 KiB
Plaintext
224 lines
4.0 KiB
Plaintext
#############
|
|
# Automatically generated by generator.py in splunk/security_content
|
|
# On Date: 2022-04-04T18:01:09 UTC
|
|
# Author: Splunk Security Research
|
|
# Contact: research@splunk.com
|
|
#############
|
|
|
|
[__mlspl_unusual_commandline_detection]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[api_call_by_user_baseline]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[attacker_tools]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[aws_service_accounts]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[baseline_blocked_outbound_connections]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[brandMonitoring_lookup]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[cloud_instances_enough_data]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[csc_lookup]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[discovered_dns_records]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[domains]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[dynamic_dns_providers_default]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[dynamic_dns_providers_local]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[escu_search_id_lookup]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[images_to_repository]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[is_net_windows_file]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[is_nirsoft_software]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[is_suspicious_file_extension_lookup]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[is_windows_system_file]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[legit_domains]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[linux_tool_discovery_process]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[local_file_inclusion_paths]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[lookup_rare_process_allow_list_default]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[lookup_rare_process_allow_list_local]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[lookup_uncommon_processes_default]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[lookup_uncommon_processes_local]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[mandatory_job_for_workflow]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[mandatory_step_for_job]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[network_acl_activity_baseline]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_S3_access_from_remote_ip]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_api_calls_from_user_roles]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_aws_cross_account_activity]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_aws_regions]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_cloud_api_calls_per_user_role]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_cloud_compute_creations_by_user]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_cloud_compute_images]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_cloud_compute_instance_types]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_cloud_instance_modifications_by_user]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_cloud_provisioning_activity_sources]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_cloud_regions]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_cmd_line_arguments]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_ec2_modifications_by_user]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_gcp_storage_access_from_remote_ip]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_running_windows_services]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[previously_seen_users_console_logins]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[prohibited_apps_launching_cmd]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[prohibited_processes]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[prohibited_softwares]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[ransomware_extensions_lookup]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[ransomware_notes_lookup]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[s3_deletion_baseline]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[security_group_activity_baseline]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[security_services_lookup]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[suspicious_writes_lookup]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|
|
[zoom_first_time_child_process]
|
|
enforceTypes = false
|
|
replicate = false
|
|
|