mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
dluxtron
441 lines
16 KiB
Plaintext
441 lines
16 KiB
Plaintext
#############
|
|
# Automatically generated by generator.py in splunk/security_content
|
|
# On Date: 2023-11-01T20:44:08 UTC
|
|
# Author: Splunk Threat Research Team - Splunk
|
|
# Contact: research@splunk.com
|
|
#############
|
|
|
|
[3cx_ioc_domains]
|
|
filename = 3cx_ioc_domains.csv
|
|
default_match = false
|
|
case_sensitive_match = false
|
|
# description = A list of domains from the 3CX supply chain attack.
|
|
match_type = WILDCARD(domain)
|
|
min_matches = 1
|
|
|
|
[__mlspl_detect_dns_data_exfiltration_using_pretrained_model_in_dsdl]
|
|
filename = __mlspl_detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.mlmodel
|
|
case_sensitive_match = false
|
|
# description = Detect DNS Data Exfiltration using pretrained Model in DSDL
|
|
|
|
[__mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl]
|
|
filename = __mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.mlmodel
|
|
case_sensitive_match = false
|
|
# description = Detect suspicious DNS txt records using Pretrained Model in DSDL
|
|
|
|
[__mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl]
|
|
filename = __mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl.mlmodel
|
|
case_sensitive_match = false
|
|
# description = Detect a suspicious processname using Pretrained Model in DSDL
|
|
|
|
[__mlspl_pretrained_dga_model_dsdl]
|
|
filename = __mlspl_pretrained_dga_model_dsdl.mlmodel
|
|
case_sensitive_match = false
|
|
# description = Detect DGA domains using Pretrained Model in DSDL
|
|
|
|
[__mlspl_risky_spl_pre_trained_model]
|
|
filename = __mlspl_risky_spl_pre_trained_model.mlmodel
|
|
default_match = false
|
|
case_sensitive_match = false
|
|
# description = Detect Risky SPL using Pretrained ML Model
|
|
min_matches = 1
|
|
|
|
[__mlspl_unusual_commandline_detection]
|
|
filename = __mlspl_unusual_commandline_detection.mlmodel
|
|
default_match = false
|
|
case_sensitive_match = false
|
|
# description = An MLTK model for detecting malicious commandlines
|
|
min_matches = 1
|
|
|
|
[ace_access_rights_lookup]
|
|
filename = ace_access_rights_lookup.csv
|
|
# description = A lookup file that will contain translations for AD object ace access rights strings
|
|
|
|
[ace_control_access_rights_lookup]
|
|
filename = ace_control_access_rights_lookup.csv
|
|
# description = A lookup file that will contain translations for AD object ace control access rights guids
|
|
|
|
[ace_flag_lookup]
|
|
filename = ace_flag_lookup.csv
|
|
# description = A lookup file that will contain translations for AD object ace flags strings
|
|
|
|
[ace_type_lookup]
|
|
filename = ace_type_lookup.csv
|
|
# description = A lookup file that will contain translations for AD object ace type strings
|
|
|
|
[advanced_audit_policy_guids]
|
|
filename = advanced_audit_policy_guids.csv
|
|
default_match = false
|
|
case_sensitive_match = false
|
|
# description = List of GUIDs associated with Windows advanced audit policies
|
|
match_type = WILDCARD(GUID)
|
|
min_matches = 1
|
|
|
|
[api_call_by_user_baseline]
|
|
collection = api_call_by_user_baseline
|
|
external_type = kvstore
|
|
# description = A collection that will contain the baseline information for number of AWS API calls per user
|
|
fields_list = arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls
|
|
|
|
[attacker_tools]
|
|
filename = attacker_tools.csv
|
|
default_match = false
|
|
case_sensitive_match = false
|
|
# description = A list of tools used by attackers
|
|
match_type = WILDCARD(attacker_tool_names)
|
|
min_matches = 1
|
|
|
|
[aws_service_accounts]
|
|
filename = aws_service_accounts.csv
|
|
# description = A lookup file that will contain AWS Service accounts
|
|
|
|
[baseline_blocked_outbound_connections]
|
|
filename = baseline_blocked_outbound_connections.csv
|
|
# description = A lookup file that will contain the baseline information for number of blocked outbound connections
|
|
|
|
[brandMonitoring_lookup]
|
|
filename = brand_monitoring.csv
|
|
default_match = false
|
|
# description = A file that contains look-a-like domains for brands that you want to monitor
|
|
match_type = WILDCARD(domain)
|
|
min_matches = 1
|
|
|
|
[builtin_groups_lookup]
|
|
filename = builtin_groups_lookup.csv
|
|
# description = A lookup file that will contain translations for builtin AD group strings
|
|
|
|
[cloud_instances_enough_data]
|
|
collection = cloud_instances_enough_data
|
|
external_type = kvstore
|
|
default_match = false
|
|
# description = A lookup to determine if you have a sufficient amount of time has passed to collect cloud instance data for behavioral searches
|
|
match_type = WILDCARD(filter)
|
|
fields_list = _key, filter, enough_data
|
|
|
|
[discovered_dns_records]
|
|
filename = discovered_dns_records.csv
|
|
default_match = false
|
|
# description = A placeholder for a list of discovered DNS records generated by the baseline discover_dns_records
|
|
min_matches = 1
|
|
|
|
[domain_admins]
|
|
filename = domain_admins.csv
|
|
case_sensitive_match = false
|
|
# description = List of domain admins
|
|
|
|
[domains]
|
|
filename = domains.csv
|
|
# description = A list of domains that can be ignored
|
|
|
|
[dynamic_dns_providers_default]
|
|
filename = dynamic_dns_providers_default.csv
|
|
case_sensitive_match = false
|
|
# description = A list of dynammic dns providers that should not be modified
|
|
match_type = WILDCARD(dynamic_dns_domains)
|
|
|
|
[dynamic_dns_providers_local]
|
|
filename = dynamic_dns_providers_local.csv
|
|
case_sensitive_match = false
|
|
# description = A list of dynammic dns providers that can be modified
|
|
match_type = WILDCARD(dynamic_dns_domains)
|
|
|
|
[hijacklibs]
|
|
filename = hijacklibs.csv
|
|
default_match = false
|
|
case_sensitive_match = false
|
|
# description = A list of potentially abused libraries in Windows
|
|
match_type = WILDCARD(library)
|
|
min_matches = 1
|
|
|
|
[images_to_repository]
|
|
filename = images_to_repository.csv
|
|
# description = Mapping images to repositories
|
|
|
|
[is_net_windows_file]
|
|
filename = is_net_windows_file.csv
|
|
default_match = false
|
|
case_sensitive_match = false
|
|
# description = A full baseline of executable files in \Windows\, including sub-directories from Server 2016 and Windows 11. Certain .net binaries may not have been captured due to different Windows SDK's or developer utilities not installed during baseline.
|
|
min_matches = 1
|
|
|
|
[is_nirsoft_software]
|
|
filename = is_nirsoft_software.csv
|
|
default_match = false
|
|
case_sensitive_match = false
|
|
# description = A subset of utilities provided by NirSoft that may be used by adversaries.
|
|
min_matches = 1
|
|
|
|
[is_suspicious_file_extension_lookup]
|
|
filename = is_suspicious_file_extension_lookup.csv
|
|
# description = A list of suspicious extensions for email attachments
|
|
match_type = WILDCARD(file_name)
|
|
|
|
[is_windows_system_file]
|
|
filename = is_windows_system_file.csv
|
|
default_match = false
|
|
case_sensitive_match = false
|
|
# description = A full baseline of executable files in Windows\System32 and Windows\Syswow64, including sub-directories from Server 2016 and Windows 10.
|
|
min_matches = 1
|
|
|
|
[legit_domains]
|
|
filename = legit_domains.csv
|
|
# description = A list of legit domains to be used as an ignore list for possible phishing sites
|
|
|
|
[linux_tool_discovery_process]
|
|
filename = linux_tool_discovery_process.csv
|
|
default_match = false
|
|
case_sensitive_match = false
|
|
# description = A list of suspicious bash commonly used by attackers via scripts
|
|
match_type = WILDCARD(process)
|
|
min_matches = 1
|
|
|
|
[local_file_inclusion_paths]
|
|
filename = local_file_inclusion_paths.csv
|
|
default_match = false
|
|
case_sensitive_match = false
|
|
# description = A list of interesting files in a local file inclusion attack
|
|
match_type = WILDCARD(local_file_inclusion_paths)
|
|
min_matches = 1
|
|
|
|
[lolbas_file_path]
|
|
filename = lolbas_file_path.csv
|
|
default_match = false
|
|
case_sensitive_match = false
|
|
# description = A list of LOLBAS and their file path used in determining if a script or binary is valid on windows
|
|
match_type = WILDCARD(lolbas_file_name)
|
|
min_matches = 1
|
|
|
|
[loldrivers]
|
|
filename = loldrivers.csv
|
|
default_match = false
|
|
case_sensitive_match = false
|
|
# description = A list of known vulnerable drivers
|
|
match_type = WILDCARD(driver_name)
|
|
min_matches = 1
|
|
|
|
[lookup_rare_process_allow_list_default]
|
|
filename = rare_process_allow_list_default.csv
|
|
default_match = false
|
|
case_sensitive_match = false
|
|
# description = A list of rare processes that are legitimate that is provided by Splunk
|
|
match_type = WILDCARD(process)
|
|
min_matches = 1
|
|
|
|
[lookup_rare_process_allow_list_local]
|
|
filename = rare_process_allow_list_local.csv
|
|
default_match = false
|
|
case_sensitive_match = false
|
|
# description = A list of rare processes that are legitimate provided by the end user
|
|
match_type = WILDCARD(process)
|
|
min_matches = 1
|
|
|
|
[lookup_uncommon_processes_default]
|
|
filename = uncommon_processes_default.csv
|
|
case_sensitive_match = false
|
|
# description = A list of processes that are not common
|
|
match_type = WILDCARD(process)
|
|
|
|
[lookup_uncommon_processes_local]
|
|
filename = uncommon_processes_local.csv
|
|
case_sensitive_match = false
|
|
# description = A list of processes that are not common
|
|
match_type = WILDCARD(process)
|
|
|
|
[mandatory_job_for_workflow]
|
|
filename = mandatory_job_for_workflow.csv
|
|
# description = A lookup file that will be used to define the mandatory job for workflow
|
|
|
|
[mandatory_step_for_job]
|
|
filename = mandatory_step_for_job.csv
|
|
# description = A lookup file that will be used to define the mandatory step for job
|
|
|
|
[network_acl_activity_baseline]
|
|
filename = network_acl_activity_baseline.csv
|
|
# description = A lookup file that will contain the baseline information for number of AWS Network ACL Activity
|
|
|
|
[previously_seen_S3_access_from_remote_ip]
|
|
collection = previously_seen_S3_access_from_remote_ip
|
|
external_type = kvstore
|
|
# description = A placeholder for a list of IPs that have access S3
|
|
fields_list = _key, bucket_name,remote_ip,earliest,latest
|
|
|
|
[previously_seen_api_calls_from_user_roles]
|
|
collection = previously_seen_api_calls_from_user_roles
|
|
external_type = kvstore
|
|
# description = A placeholder for a list of IPs that have access S3
|
|
fields_list = _key,earliest,latest,userName,eventName
|
|
|
|
[previously_seen_aws_cross_account_activity]
|
|
collection = previously_seen_aws_cross_account_activity
|
|
external_type = kvstore
|
|
# description = A placeholder for a list of AWS accounts and assumed roles
|
|
fields_list = _key,firstTime,lastTime,requestingAccountId,requestedAccountId
|
|
|
|
[previously_seen_aws_regions]
|
|
collection = previously_seen_aws_regions
|
|
external_type = kvstore
|
|
# description = A place holder for a list of used AWS regions
|
|
fields_list = _key,earliest,latest,awsRegion
|
|
|
|
[previously_seen_cloud_api_calls_per_user_role]
|
|
collection = previously_seen_cloud_api_calls_per_user_role
|
|
external_type = kvstore
|
|
# description = A table of users, commands, and the first and last time that they have been seen
|
|
fields_list = _key, user, command, firstTimeSeen, lastTimeSeen, enough_data
|
|
|
|
[previously_seen_cloud_compute_creations_by_user]
|
|
collection = previously_seen_cloud_compute_creations_by_user
|
|
external_type = kvstore
|
|
# description = A table of previously seen users creating cloud instances
|
|
fields_list = _key, firstTimeSeen, lastTimeSeen, user, enough_data
|
|
|
|
[previously_seen_cloud_compute_images]
|
|
collection = previously_seen_cloud_compute_images
|
|
external_type = kvstore
|
|
# description = A table of previously seen Cloud image IDs
|
|
fields_list = _key, firstTimeSeen, lastTimeSeen, image_id, enough_data
|
|
|
|
[previously_seen_cloud_compute_instance_types]
|
|
collection = previously_seen_cloud_compute_instance_types
|
|
external_type = kvstore
|
|
# description = A place holder for a list of used cloud compute instance types
|
|
fields_list = _key, firstTimeSeen, lastTimeSeen, instance_type, enough_data
|
|
|
|
[previously_seen_cloud_instance_modifications_by_user]
|
|
collection = previously_seen_cloud_instance_modifications_by_user
|
|
external_type = kvstore
|
|
# description = A table of users seen making instance modifications, and the first and last time that the activity was observed
|
|
fields_list = _key, firstTimeSeen, lastTimeSeen, user, enough_data
|
|
|
|
[previously_seen_cloud_provisioning_activity_sources]
|
|
collection = previously_seen_cloud_provisioning_activity_sources
|
|
external_type = kvstore
|
|
# description = A table of source IPs, geographic locations, and the first and last time that they have that done cloud provisioning activities
|
|
fields_list = _key, src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data
|
|
|
|
[previously_seen_cloud_regions]
|
|
collection = previously_seen_cloud_regions
|
|
external_type = kvstore
|
|
# description = A table of vendor_region values and the first and last time that they have been observed in cloud provisioning activities
|
|
fields_list = _key, firstTimeSeen, lastTimeSeen, vendor_region, enough_data
|
|
|
|
[previously_seen_cmd_line_arguments]
|
|
filename = previously_seen_cmd_line_arguments.csv
|
|
# description = A placeholder for a list of cmd line arugments that been seen before
|
|
|
|
[previously_seen_ec2_modifications_by_user]
|
|
filename = previously_seen_ec2_modifications_by_user.csv
|
|
# description = A place holder for a list of AWS EC2 modifications done by each user
|
|
|
|
[previously_seen_gcp_storage_access_from_remote_ip]
|
|
collection = previously_seen_gcp_storage_access_from_remote_ip
|
|
external_type = kvstore
|
|
# description = A place holder for a list of GCP storage access from remote IPs
|
|
fields_list = _key, firstTime, lastTime, bucket_name, remote_ip, operation, request_uri
|
|
|
|
[previously_seen_running_windows_services]
|
|
collection = previously_seen_running_windows_services
|
|
external_type = kvstore
|
|
# description = A placeholder for the list of Windows Services running
|
|
fields_list = _key, service, firstTimeSeen, lastTimeSeen
|
|
|
|
[previously_seen_users_console_logins]
|
|
collection = previously_seen_users_console_logins
|
|
external_type = kvstore
|
|
# description = A table of users seen doing console logins, and the first and last time that the activity was observed
|
|
fields_list = _key, firstTime, lastTime, user, src, City, Region, Country
|
|
|
|
[privileged_azure_ad_roles]
|
|
filename = privileged_azure_ad_roles.csv
|
|
default_match = false
|
|
case_sensitive_match = false
|
|
# description = A list of privileged Azure Active Directory roles.
|
|
match_type = WILDCARD(azureadrole)
|
|
min_matches = 1
|
|
|
|
[prohibited_apps_launching_cmd]
|
|
filename = prohibited_apps_launching_cmd.csv
|
|
# description = A list of processes that should not be launching cmd.exe
|
|
match_type = WILDCARD(prohibited_applications)
|
|
|
|
[prohibited_processes]
|
|
filename = prohibited_processes.csv
|
|
# description = A list of processes that have been marked as prohibited
|
|
|
|
[ransomware_extensions_lookup]
|
|
filename = ransomware_extensions.csv
|
|
default_match = false
|
|
case_sensitive_match = false
|
|
# description = A list of file extensions that are associated with ransomware
|
|
match_type = WILDCARD(Extensions)
|
|
min_matches = 1
|
|
|
|
[ransomware_notes_lookup]
|
|
filename = ransomware_notes.csv
|
|
default_match = false
|
|
case_sensitive_match = false
|
|
# description = A list of file names that are ransomware note files
|
|
match_type = WILDCARD(ransomware_notes)
|
|
min_matches = 1
|
|
|
|
[remote_access_software]
|
|
filename = remote_access_software.csv
|
|
default_match = false
|
|
case_sensitive_match = false
|
|
# description = A list of Remote Access Software
|
|
match_type = WILDCARD(remote_software)
|
|
min_matches = 1
|
|
|
|
[s3_deletion_baseline]
|
|
collection = s3_deletion_baseline
|
|
external_type = kvstore
|
|
# description = A placeholder for the baseline information for AWS S3 deletions
|
|
fields_list = _key, arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls
|
|
|
|
[security_group_activity_baseline]
|
|
collection = security_group_activity_baseline
|
|
external_type = kvstore
|
|
# description = A placeholder for the baseline information for AWS security groups
|
|
fields_list = _key, arn,latestCount,numDataPoints,avgApiCalls,stdevApiCalls
|
|
|
|
[security_services_lookup]
|
|
filename = security_services.csv
|
|
default_match = false
|
|
# description = A list of services that deal with security
|
|
match_type = WILDCARD(service)
|
|
min_matches = 1
|
|
|
|
[splunk_risky_command]
|
|
filename = splunk_risky_command_20231003.csv
|
|
default_match = false
|
|
case_sensitive_match = false
|
|
# description = A list of Risky Splunk Command that are candidates for abuse
|
|
match_type = WILDCARD(splunk_risky_command)
|
|
min_matches = 1
|
|
|
|
[suspicious_writes_lookup]
|
|
filename = suspicious_files.csv
|
|
default_match = false
|
|
# description = A list of suspicious file names
|
|
match_type = WILDCARD(file)
|
|
min_matches = 1
|
|
|
|
[windows_protocol_handlers]
|
|
filename = windows_protocol_handlers.csv
|
|
default_match = false
|
|
case_sensitive_match = false
|
|
# description = A list of Windows Protocol Handlers
|
|
match_type = WILDCARD(handler)
|
|
min_matches = 1
|
|
|
|
[zoom_first_time_child_process]
|
|
collection = zoom_first_time_child_process
|
|
external_type = kvstore
|
|
# description = A list of suspicious file names
|
|
fields_list = _key, dest, process_name, firstTimeSeen, lastTimeSeen
|
|
|
|
|
|
### Default transforms definitions for the lookup files we ship ###
|
|
[mitre_enrichment]
|
|
filename = mitre_enrichment.csv
|
|
# description = A lookup file that is created by generate.py |