admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
create-vscode-schema
splunk-security_content/lookups
T
History
Raven Tait 498a80d469 Detections for default user agents (#3842) 
* Detections for default user agents

* various updates for user agent detections

* Apply suggestions from code review

* Rename suspicious_user_agent.yml to suspicious_user_agents.yml

---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
2026-01-07 09:34:04 +05:30
..
__mlspl_detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.mlmodel
Adding missing lookup files
2023-06-12 13:56:20 -07:00
__mlspl_detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml
first batch of updates to
2024-12-23 15:14:19 -08:00
__mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.mlmodel
adding detect suspicious dns txt records using pretrained model in dsdl
2023-01-17 15:26:01 -08:00
__mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml
first batch of updates to
2024-12-23 15:14:19 -08:00
__mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl.mlmodel
Detection name update
2023-02-07 15:31:48 +01:00
__mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml
first batch of updates to
2024-12-23 15:14:19 -08:00
__mlspl_pretrained_dga_model_dsdl.mlmodel
changing files
2022-09-28 12:36:40 -07:00
__mlspl_pretrained_dga_model_dsdl.yml
first batch of updates to
2024-12-23 15:14:19 -08:00
__mlspl_unusual_commandline_detection.mlmodel
Updating mlmodel to 5.3.x specification as well as the test apparatus
2022-01-25 21:42:16 -05:00
__mlspl_unusual_commandline_detection.yml
Removing default match from lookups
2025-03-26 11:01:05 -05:00
3cx_ioc_domains.csv
dns
2023-03-30 12:15:41 -06:00
3cx_ioc_domains.yml
Removing default match from lookups
2025-03-26 11:01:05 -05:00
ace_access_rights_lookup.csv
adding AD ACL and GPO related detections
2024-07-02 11:52:21 +10:00
ace_access_rights_lookup.yml
first batch of updates to
2024-12-23 15:14:19 -08:00
ace_flag_lookup.csv
adding AD ACL and GPO related detections
2024-07-02 11:52:21 +10:00
ace_flag_lookup.yml
more cleanup of lookups to follow new format.
2025-01-03 10:27:49 -08:00
ace_type_lookup.csv
adding AD ACL and GPO related detections
2024-07-02 11:52:21 +10:00
ace_type_lookup.yml
first batch of updates to
2024-12-23 15:14:19 -08:00
advanced_audit_policy_guids.csv
renaming advanced audit policy guids lookup
2023-02-13 12:03:49 -05:00
advanced_audit_policy_guids.yml
Removing default match from lookups
2025-03-26 11:01:05 -05:00
api_call_by_user_baseline.yml
remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.
2025-01-03 13:58:18 -08:00
applockereventcodes.csv
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
applockereventcodes.yml
Removing default match from lookups
2025-03-26 11:01:05 -05:00
asr_rules.csv
update: lookups with additional data
2025-01-30 20:33:48 +01:00
asr_rules.yml
Removing default match from lookups
2025-03-26 11:01:05 -05:00
attacker_tools.csv
update time 🚀
2025-06-30 13:55:55 +02:00
attacker_tools.yml
update time 🚀
2025-06-30 13:55:55 +02:00
aws_service_accounts.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
aws_service_accounts.yml
first batch of updates to
2024-12-23 15:14:19 -08:00
baseline_blocked_outbound_connections.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
baseline_blocked_outbound_connections.yml
more cleanup of lookups to follow new format.
2025-01-03 10:27:49 -08:00
brandmonitoring_lookup.csv
more cleanup of lookups to follow new format.
2025-01-03 10:27:49 -08:00
brandmonitoring_lookup.yml
Removing default match from lookups
2025-03-26 11:01:05 -05:00
browser_app_list.csv
quasar_and_loader
2025-07-16 10:23:20 +02:00
browser_app_list.yml
quasar_and_loader
2025-07-17 16:09:40 +02:00
builtin_groups_lookup.csv
update: lookups with additional data
2025-01-30 20:33:48 +01:00
builtin_groups_lookup.yml
update: lookups with additional data
2025-01-30 20:33:48 +01:00
char_conversion_matrix.csv
Release 4.19.0
2024-01-10 17:21:34 +00:00
char_conversion_matrix.yml
Removing default match from lookups
2025-03-26 11:01:05 -05:00
cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools.csv
add Cisco Secure Firewall - Remote Access Software Usage Traffic
2025-05-28 19:33:18 +02:00
cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools.yml
add Cisco Secure Firewall - Remote Access Software Usage Traffic
2025-05-28 19:33:18 +02:00
cisco_secure_firewall_filetype_lookup.csv
cisco secure firewall detections - second batch
2025-04-09 12:33:51 +02:00
cisco_secure_firewall_filetype_lookup.yml
New Rules & Updates - Oct 25 (#3726)
2025-10-24 14:19:48 -07:00
cisco_snort_ids_to_threat_mapping.csv
add lokibot
2025-12-08 14:06:28 +01:00
cisco_snort_ids_to_threat_mapping.yml
update snort lookup
2025-12-08 13:53:41 +01:00
cloud_instances_enough_data.yml
Removing default match from lookups
2025-03-26 11:01:05 -05:00
decommissioned_buckets.yml
Removing default match from lookups
2025-03-26 11:01:05 -05:00
discovered_dns_records.csv
app inspect failures fixes
2020-12-08 14:56:39 -08:00
discovered_dns_records.yml
Removing default match from lookups
2025-03-26 11:01:05 -05:00
domain_admins.csv
adding new detection - diamond ticket
2023-10-06 15:46:36 -04:00
domain_admins.yml
Second round of lookup file cleanup
2024-12-23 15:23:52 -08:00
domains.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
domains.yml
Second round of lookup file cleanup
2024-12-23 15:23:52 -08:00
dynamic_dns_providers_default.csv
update: lookups with additional data
2025-01-30 20:33:48 +01:00
dynamic_dns_providers_default.yml
update: lookups with additional data
2025-01-30 20:33:48 +01:00
dynamic_dns_providers_local.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
dynamic_dns_providers_local.yml
Second round of lookup file cleanup
2024-12-23 15:23:52 -08:00
hijacklibs_loaded.csv
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
hijacklibs_loaded.yml
Adding default match back to lookups where used
2025-03-26 13:03:42 -05:00
hijacklibs.csv
T1003.001 Update
2022-08-25 08:04:20 -06:00
hijacklibs.yml
Removing default match from lookups
2025-03-26 11:01:05 -05:00
images_to_repository.csv
updated detections
2021-09-06 10:59:00 +02:00
images_to_repository.yml
Second round of lookup file cleanup
2024-12-23 15:23:52 -08:00
is_net_windows_file.csv
more cleanup of lookups to follow new format.
2025-01-03 10:27:49 -08:00
is_net_windows_file.yml
Removing default match from lookups
2025-03-26 11:01:05 -05:00
is_nirsoft_software.csv
New Rules & Updates - Oct 25 (#3726)
2025-10-24 14:19:48 -07:00
is_nirsoft_software.yml
New Rules & Updates - Oct 25 (#3726)
2025-10-24 14:19:48 -07:00
is_suspicious_file_extension_lookup.csv
add additional suspicious file extensions
2020-11-18 16:19:11 -05:00
is_suspicious_file_extension_lookup.yml
Second round of lookup file cleanup
2024-12-23 15:23:52 -08:00
is_windows_system_file.csv
more cleanup of lookups to follow new format.
2025-01-03 10:27:49 -08:00
is_windows_system_file.yml
Removing default match from lookups
2025-03-26 11:01:05 -05:00
k8s_container_network_io_baseline.yml
remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.
2025-01-03 13:58:18 -08:00
k8s_container_network_io_ratio_baseline.yml
remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.
2025-01-03 13:58:18 -08:00
k8s_process_resource_baseline.yml
remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.
2025-01-03 13:58:18 -08:00
k8s_process_resource_ratio_baseline.yml
remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.
2025-01-03 13:58:18 -08:00
legit_domains.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
legit_domains.yml
another round of lookup file updates
2024-12-23 15:45:58 -08:00
linux_tool_discovery_process.csv
combined the rest 2
2022-02-17 16:28:19 -08:00
linux_tool_discovery_process.yml
Removing default match from lookups
2025-03-26 11:01:05 -05:00
local_file_inclusion_paths.csv
new detection
2021-08-23 13:07:23 +02:00
local_file_inclusion_paths.yml
Removing default match from lookups
2025-03-26 11:01:05 -05:00
lolbas_file_path.csv
more cleanup of lookups to follow new format.
2025-01-03 10:27:49 -08:00
lolbas_file_path.yml
Adding default match back to lookups where used
2025-03-26 13:03:42 -05:00
loldrivers.csv
Bespoke Drivers
2022-12-31 14:14:11 -07:00
loldrivers.yml
Removing default match from lookups
2025-03-26 11:01:05 -05:00
lookup_rare_process_allow_list_default.csv
more cleanup of lookups to follow new format.
2025-01-03 10:27:49 -08:00
lookup_rare_process_allow_list_default.yml
Removing default match from lookups
2025-03-26 11:01:05 -05:00
lookup_rare_process_allow_list_local.csv
more cleanup of lookups to follow new format.
2025-01-03 10:27:49 -08:00
lookup_rare_process_allow_list_local.yml
Removing default match from lookups
2025-03-26 11:01:05 -05:00
lookup_uncommon_processes_default.csv
more cleanup of lookups to follow new format.
2025-01-03 10:27:49 -08:00
lookup_uncommon_processes_default.yml
another round of lookup file updates
2024-12-23 15:45:58 -08:00
lookup_uncommon_processes_local.csv
more cleanup of lookups to follow new format.
2025-01-03 10:27:49 -08:00
lookup_uncommon_processes_local.yml
another round of lookup file updates
2024-12-23 15:45:58 -08:00
malicious_powershell_strings.csv
updating lookup
2025-03-03 16:20:52 -08:00
malicious_powershell_strings.yml
updating lookup
2025-03-03 16:20:52 -08:00
malware_user_agents.csv
Detections for default user agents (#3842)
2026-01-07 09:34:04 +05:30
malware_user_agents.yml
Detections for default user agents (#3842)
2026-01-07 09:34:04 +05:30
mandatory_job_for_workflow.csv
circle ci detecction
2021-09-02 10:42:01 +02:00
mandatory_job_for_workflow.yml
More cleanup of lookups
2024-12-23 16:06:48 -08:00
mandatory_step_for_job.csv
circle ci detecction
2021-09-01 17:54:38 +02:00
mandatory_step_for_job.yml
another round of lookup file updates
2024-12-23 15:45:58 -08:00
msad_guid_lookup.csv
adding AD ACL and GPO related detections
2024-07-02 11:52:21 +10:00
msad_guid_lookup.yml
another round of lookup file updates
2024-12-23 15:45:58 -08:00
network_acl_activity_baseline.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
network_acl_activity_baseline.yml
finish lookup cleanup
2025-01-03 11:05:52 -08:00
previously_seen_api_calls_from_user_roles.yml
remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.
2025-01-03 13:58:18 -08:00
previously_seen_aws_cross_account_activity.yml
remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.
2025-01-03 13:58:18 -08:00
previously_seen_aws_regions.yml
remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.
2025-01-03 13:58:18 -08:00
previously_seen_cloud_api_calls_per_user_role.yml
remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.
2025-01-03 13:58:18 -08:00
previously_seen_cloud_compute_creations_by_user.yml
remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.
2025-01-03 13:58:18 -08:00
previously_seen_cloud_compute_images.yml
remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.
2025-01-03 13:58:18 -08:00
previously_seen_cloud_compute_instance_types.yml
remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.
2025-01-03 13:58:18 -08:00
previously_seen_cloud_instance_modifications_by_user.yml
remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.
2025-01-03 13:58:18 -08:00
previously_seen_cloud_provisioning_activity_sources.yml
remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.
2025-01-03 13:58:18 -08:00
previously_seen_cloud_regions.yml
remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.
2025-01-03 13:58:18 -08:00
previously_seen_cmd_line_arguments.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_cmd_line_arguments.yml
more cleanup of lookups to follow new format.
2025-01-03 10:27:49 -08:00
previously_seen_ec2_amis_lookup.yml
Fix more errors with missing lookups, baselines, and detections
2025-01-16 10:45:46 -08:00
previously_seen_ec2_instance_types_lookup.yml
Fix more errors with missing lookups, baselines, and detections
2025-01-16 10:45:46 -08:00
previously_seen_ec2_launches_by_user_lookup.yml
Fix more errors with missing lookups, baselines, and detections
2025-01-16 10:45:46 -08:00
previously_seen_ec2_modifications_by_user.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_ec2_modifications_by_user.yml
more cleanup of lookups to follow new format.
2025-01-03 10:27:49 -08:00
previously_seen_gcp_storage_access_from_remote_ip.yml
remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.
2025-01-03 13:58:18 -08:00
previously_seen_provisioning_activity_src.yml
progress on input/output lookup
2025-01-03 16:35:39 -08:00
previously_seen_running_windows_services.yml
remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.
2025-01-03 13:58:18 -08:00
previously_seen_s3_access_from_remote_ip.yml
remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.
2025-01-03 13:58:18 -08:00
previously_seen_users_console_logins.yml
remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.
2025-01-03 13:58:18 -08:00
privileged_azure_ad_roles.csv
more cleanup of lookups to follow new format.
2025-01-03 10:27:49 -08:00
privileged_azure_ad_roles.yml
Removing default match from lookups
2025-03-26 11:01:05 -05:00
prohibited_apps_launching_cmd.csv
more cleanup of lookups to follow new format.
2025-01-03 10:27:49 -08:00
prohibited_apps_launching_cmd.yml
finish lookup cleanup
2025-01-03 11:05:52 -08:00
prohibited_processes.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
prohibited_processes.yml
first batch of updates to
2024-12-23 15:14:19 -08:00
pua_named_pipes.csv
Add tuoni content and named pipe detection (#3816)
2025-12-08 21:25:09 +01:00
pua_named_pipes.yml
Add tuoni content and named pipe detection (#3816)
2025-12-08 21:25:09 +01:00
pua_user_agents.csv
Detections for default user agents (#3842)
2026-01-07 09:34:04 +05:30
pua_user_agents.yml
Detections for default user agents (#3842)
2026-01-07 09:34:04 +05:30
ransomware_extensions_lookup.csv
Fix Issues & Updates (#3705)
2025-10-13 09:18:21 -07:00
ransomware_extensions_lookup.yml
Fix Issues & Updates (#3705)
2025-10-13 09:18:21 -07:00
ransomware_notes_lookup.csv
interlock_ransomware
2025-07-29 12:31:56 +02:00
ransomware_notes_lookup.yml
interlock_ransomware
2025-07-28 11:13:15 +02:00
remote_access_software_exceptions.yml
remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.
2025-01-03 13:58:18 -08:00
remote_access_software.csv
fix: addtl remote_utility typo in remote_access_software.csv
2025-04-04 11:32:32 -04:00
remote_access_software.yml
chore: update lookup date and version
2025-04-04 11:32:45 -04:00
rmm_user_agents.csv
Detections for default user agents (#3842)
2026-01-07 09:34:04 +05:30
rmm_user_agents.yml
Detections for default user agents (#3842)
2026-01-07 09:34:04 +05:30
s3_deletion_baseline.yml
remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.
2025-01-03 13:58:18 -08:00
scripting_tools_user_agents.csv
HTTP Request Smuggling (#3731)
2025-10-21 14:08:57 -07:00
scripting_tools_user_agents.yml
HTTP Request Smuggling (#3731)
2025-10-21 14:08:57 -07:00
security_group_activity_baseline.yml
remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.
2025-01-03 13:58:18 -08:00
security_services_lookup.csv
update: lookups with additional data
2025-01-30 20:33:48 +01:00
security_services_lookup.yml
Removing default match from lookups
2025-03-26 11:01:05 -05:00
sslbl_ssl_certificate_blacklist.csv
cisco secure firewall detections - first batch
2025-04-03 14:21:27 +02:00
sslbl_ssl_certificate_blacklist.yml
update lookup name
2025-04-03 14:24:53 +02:00
suspicious_c2_named_pipes.csv
Add tuoni content and named pipe detection (#3816)
2025-12-08 21:25:09 +01:00
suspicious_c2_named_pipes.yml
Add tuoni content and named pipe detection (#3816)
2025-12-08 21:25:09 +01:00
suspicious_c2_user_agents.csv
Detections for default user agents (#3842)
2026-01-07 09:34:04 +05:30
suspicious_c2_user_agents.yml
Detections for default user agents (#3842)
2026-01-07 09:34:04 +05:30
suspicious_named_pipes.csv
Add tuoni content and named pipe detection (#3816)
2025-12-08 21:25:09 +01:00
suspicious_named_pipes.yml
Add tuoni content and named pipe detection (#3816)
2025-12-08 21:25:09 +01:00
suspicious_ports_list.csv
Update suspicious_ports_list.csv
2025-07-01 23:07:46 +02:00
suspicious_ports_list.yml
add new detections, story and other cool things
2025-07-01 23:04:48 +02:00
suspicious_rmm_named_pipes.csv
Add tuoni content and named pipe detection (#3816)
2025-12-08 21:25:09 +01:00
suspicious_rmm_named_pipes.yml
Add tuoni content and named pipe detection (#3816)
2025-12-08 21:25:09 +01:00
suspicious_writes_lookup.csv
more cleanup of lookups to follow new format.
2025-01-03 10:27:49 -08:00
suspicious_writes_lookup.yml
Removing default match from lookups
2025-03-26 11:01:05 -05:00
threat_snort_count.csv
updating IDs
2025-09-24 11:20:12 -07:00
threat_snort_count.yml
updating IDs
2025-09-24 11:20:12 -07:00
typo_squatted_python_packages.csv
the final countdown
2025-07-06 02:57:39 +02:00
typo_squatted_python_packages.yml
the final countdown
2025-07-06 02:57:39 +02:00
windows_protocol_handlers.csv
Windows Protocol Handler
2022-07-12 14:43:39 -06:00
windows_protocol_handlers.yml
Removing default match from lookups
2025-03-26 11:01:05 -05:00
windows_suspicious_services.csv
Update windows_suspicious_services.csv
2025-02-19 15:29:33 -05:00
windows_suspicious_services.yml
Merge branch 'develop' into win_sus_service_fix
2025-03-28 09:50:36 -07:00
windows_suspicious_tasks.csv
Add files via upload
2025-02-07 13:34:34 -05:00
windows_suspicious_tasks.yml
Removing default match from lookups
2025-03-26 11:01:05 -05:00
zoom_first_time_child_process.yml
remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.
2025-01-03 13:58:18 -08:00