splunk-security_content/lookups/lookup_uncommon_processes_default.csv at data_source_bug_fix

mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00

Files

T

pyth0n1c 29b2332652 more cleanup of lookups to follow new format.

this involved renaming some CSVs to remove the
dates from them or force their naming schema to
match the corresponding YML name for CSV
detections

2025-01-03 10:27:49 -08:00

1	process_name	uncommon_default	category_default	analytic_story_default	kill_chain_phase_default	mitre_attack_default
2	sethc.exe	true	needs_accessibility	Windows Privilege Escalation	Actions on Objectives	Execution\|Accessibility Features
3	utilman.exe	true	needs_accessibility	Windows Privilege Escalation	Actions on Objectives	Execution\|Accessibility Features
4	osk.exe	true	needs_accessibility	Windows Privilege Escalation	Actions on Objectives	Execution\|Accessibility Features
5	magnify.exe	true	needs_accessibility	Windows Privilege Escalation	Actions on Objectives	Execution\|Accessibility Features
6	narrator.exe	true	needs_accessibility	Windows Privilege Escalation	Actions on Objectives	Execution\|Accessibility Features
7	displayswitch.exe	true	needs_accessibility	Windows Privilege Escalation	Actions on Objectives	Execution\|Accessibility Features
8	atbroker.exe	true	needs_accessibility	Windows Privilege Escalation	Actions on Objectives	Execution\|Accessibility Features
9	quser.exe	true		DHS Report TA18-074A\|Unusual Processes	Actions on Objectives	Execution