mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
351 lines
15 KiB
JSON
351 lines
15 KiB
JSON
[
|
|
{
|
|
"name": "__mlspl_unusual_commandline_detection",
|
|
"description": "An MLTK model for detecting malicious commandlines",
|
|
"filename": "__mlspl_unusual_commandline_detection.mlmodel",
|
|
"default_match": "false",
|
|
"min_matches": 1,
|
|
"case_sensitive_match": "false"
|
|
},
|
|
{
|
|
"name": "api_call_by_user_baseline",
|
|
"description": "A collection that will contain the baseline information for number of AWS API calls per user",
|
|
"collection": "api_call_by_user_baseline",
|
|
"fields_list": "arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls"
|
|
},
|
|
{
|
|
"name": "attacker_tools",
|
|
"description": "A list of tools used by attackers",
|
|
"filename": "attacker_tools.csv",
|
|
"default_match": "false",
|
|
"match_type": "WILDCARD(attacker_tool_names)",
|
|
"min_matches": 1,
|
|
"case_sensitive_match": "false"
|
|
},
|
|
{
|
|
"name": "aws_service_accounts",
|
|
"description": "A lookup file that will contain AWS Service accounts",
|
|
"filename": "aws_service_accounts.csv"
|
|
},
|
|
{
|
|
"name": "baseline_blocked_outbound_connections",
|
|
"description": "A lookup file that will contain the baseline information for number of blocked outbound connections",
|
|
"filename": "baseline_blocked_outbound_connections.csv"
|
|
},
|
|
{
|
|
"name": "brandMonitoring_lookup",
|
|
"description": "A file that contains look-a-like domains for brands that you want to monitor",
|
|
"filename": "brand_monitoring.csv",
|
|
"default_match": "false",
|
|
"match_type": "WILDCARD(domain)",
|
|
"min_matches": 1
|
|
},
|
|
{
|
|
"name": "cloud_instances_enough_data",
|
|
"description": "A lookup to determine if you have a sufficient amount of time has passed to collect cloud instance data for behavioral searches",
|
|
"collection": "cloud_instances_enough_data",
|
|
"fields_list": "_key, filter, enough_data",
|
|
"default_match": "false",
|
|
"match_type": "WILDCARD(filter)"
|
|
},
|
|
{
|
|
"name": "csc_lookup",
|
|
"description": "The CSC control numbers and names",
|
|
"filename": "csc_lookup.csv",
|
|
"min_matches": 1
|
|
},
|
|
{
|
|
"name": "discovered_dns_records",
|
|
"description": "A placeholder for a list of discovered DNS records generated by the baseline discover_dns_records",
|
|
"filename": "discovered_dns_records.csv",
|
|
"default_match": "false",
|
|
"min_matches": 1
|
|
},
|
|
{
|
|
"name": "domains",
|
|
"description": "A list of domains that can be ignored",
|
|
"filename": "domains.csv"
|
|
},
|
|
{
|
|
"name": "dynamic_dns_providers_default",
|
|
"description": "A list of dynammic dns providers that should not be modified",
|
|
"filename": "dynamic_dns_providers_default.csv",
|
|
"match_type": "WILDCARD(dynamic_dns_domains)",
|
|
"case_sensitive_match": "false"
|
|
},
|
|
{
|
|
"name": "dynamic_dns_providers_local",
|
|
"description": "A list of dynammic dns providers that can be modified",
|
|
"filename": "dynamic_dns_providers_local.csv",
|
|
"match_type": "WILDCARD(dynamic_dns_domains)",
|
|
"case_sensitive_match": "false"
|
|
},
|
|
{
|
|
"name": "escu_search_id_lookup",
|
|
"description": "A placeholder lookup file to hold information for ESCU Usage dashboard",
|
|
"filename": "escu_search_id.csv"
|
|
},
|
|
{
|
|
"name": "images_to_repository",
|
|
"description": "Mapping images to repositories",
|
|
"filename": "images_to_repository.csv"
|
|
},
|
|
{
|
|
"name": "is_net_windows_file",
|
|
"description": "A full baseline of executable files in \\Windows\\, including sub-directories from Server 2016 and Windows 11. Certain .net binaries may not have been captured due to different Windows SDK's or developer utilities not installed during baseline.",
|
|
"filename": "is_net_windows_file.csv",
|
|
"default_match": "false",
|
|
"min_matches": 1,
|
|
"case_sensitive_match": "false"
|
|
},
|
|
{
|
|
"name": "is_nirsoft_software",
|
|
"description": "A subset of utilities provided by NirSoft that may be used by adversaries.",
|
|
"filename": "is_nirsoft_software.csv",
|
|
"default_match": "false",
|
|
"min_matches": 1,
|
|
"case_sensitive_match": "false"
|
|
},
|
|
{
|
|
"name": "is_suspicious_file_extension_lookup",
|
|
"description": "A list of suspicious extensions for email attachments",
|
|
"filename": "is_suspicious_file_extension_lookup.csv",
|
|
"match_type": "WILDCARD(file_name)"
|
|
},
|
|
{
|
|
"name": "is_windows_system_file",
|
|
"description": "A full baseline of executable files in Windows\\System32 and Windows\\Syswow64, including sub-directories from Server 2016 and Windows 10.",
|
|
"filename": "is_windows_system_file.csv",
|
|
"default_match": "false",
|
|
"min_matches": 1,
|
|
"case_sensitive_match": "false"
|
|
},
|
|
{
|
|
"name": "legit_domains",
|
|
"description": "A list of legit domains to be used as an ignore list for possible phishing sites",
|
|
"filename": "legit_domains.csv"
|
|
},
|
|
{
|
|
"name": "linux_tool_discovery_process",
|
|
"description": "A list of suspicious bash commonly used by attackers via scripts",
|
|
"filename": "linux_tool_discovery_process.csv",
|
|
"default_match": "false",
|
|
"match_type": "WILDCARD(process)",
|
|
"min_matches": 1,
|
|
"case_sensitive_match": "false"
|
|
},
|
|
{
|
|
"name": "local_file_inclusion_paths",
|
|
"description": "A list of interesting files in a local file inclusion attack",
|
|
"filename": "local_file_inclusion_paths.csv",
|
|
"default_match": "false",
|
|
"match_type": "WILDCARD(local_file_inclusion_paths)",
|
|
"min_matches": 1,
|
|
"case_sensitive_match": "false"
|
|
},
|
|
{
|
|
"name": "lookup_rare_process_allow_list_default",
|
|
"description": "A list of rare processes that are legitimate that is provided by Splunk",
|
|
"filename": "rare_process_allow_list_default.csv",
|
|
"default_match": "false",
|
|
"match_type": "WILDCARD(process)",
|
|
"min_matches": 1,
|
|
"case_sensitive_match": "false"
|
|
},
|
|
{
|
|
"name": "lookup_rare_process_allow_list_local",
|
|
"description": "A list of rare processes that are legitimate provided by the end user",
|
|
"filename": "rare_process_allow_list_local.csv",
|
|
"default_match": "false",
|
|
"match_type": "WILDCARD(process)",
|
|
"min_matches": 1,
|
|
"case_sensitive_match": "false"
|
|
},
|
|
{
|
|
"name": "lookup_uncommon_processes_default",
|
|
"description": "A list of processes that are not common",
|
|
"filename": "uncommon_processes_default.csv",
|
|
"match_type": "WILDCARD(process)",
|
|
"case_sensitive_match": "false"
|
|
},
|
|
{
|
|
"name": "lookup_uncommon_processes_local",
|
|
"description": "A list of processes that are not common",
|
|
"filename": "uncommon_processes_local.csv",
|
|
"match_type": "WILDCARD(process)",
|
|
"case_sensitive_match": "false"
|
|
},
|
|
{
|
|
"name": "mandatory_job_for_workflow",
|
|
"description": "A lookup file that will be used to define the mandatory job for workflow",
|
|
"filename": "mandatory_job_for_workflow.csv"
|
|
},
|
|
{
|
|
"name": "mandatory_step_for_job",
|
|
"description": "A lookup file that will be used to define the mandatory step for job",
|
|
"filename": "mandatory_step_for_job.csv"
|
|
},
|
|
{
|
|
"name": "network_acl_activity_baseline",
|
|
"description": "A lookup file that will contain the baseline information for number of AWS Network ACL Activity",
|
|
"filename": "network_acl_activity_baseline.csv"
|
|
},
|
|
{
|
|
"name": "previously_seen_S3_access_from_remote_ip",
|
|
"description": "A placeholder for a list of IPs that have access S3",
|
|
"filename": "previously_seen_S3_access_from_remote_ip.csv"
|
|
},
|
|
{
|
|
"name": "previously_seen_api_calls_from_user_roles",
|
|
"description": "A placeholder for a list of AWS API calls for each user role",
|
|
"filename": "previously_seen_api_calls_from_user_roles.csv"
|
|
},
|
|
{
|
|
"name": "previously_seen_aws_cross_account_activity",
|
|
"description": "A placeholder for a list of AWS accounts and assumed roles",
|
|
"filename": "previously_seen_aws_cross_account_activity.csv"
|
|
},
|
|
{
|
|
"name": "previously_seen_aws_regions",
|
|
"description": "A place holder for a list of used AWS regions",
|
|
"filename": "previously_seen_aws_regions.csv",
|
|
"default_match": "false",
|
|
"min_matches": 1
|
|
},
|
|
{
|
|
"name": "previously_seen_cloud_api_calls_per_user_role",
|
|
"description": "A table of users, commands, and the first and last time that they have been seen",
|
|
"collection": "previously_seen_cloud_api_calls_per_user_role",
|
|
"fields_list": "_key, user, command, firstTimeSeen, lastTimeSeen, enough_data"
|
|
},
|
|
{
|
|
"name": "previously_seen_cloud_compute_creations_by_user",
|
|
"description": "A table of previously seen users creating cloud instances",
|
|
"collection": "previously_seen_cloud_compute_creations_by_user",
|
|
"fields_list": "_key, firstTimeSeen, lastTimeSeen, user, enough_data"
|
|
},
|
|
{
|
|
"name": "previously_seen_cloud_compute_images",
|
|
"description": "A table of previously seen Cloud image IDs",
|
|
"collection": "previously_seen_cloud_compute_images",
|
|
"fields_list": "_key, firstTimeSeen, lastTimeSeen, image_id, enough_data"
|
|
},
|
|
{
|
|
"name": "previously_seen_cloud_compute_instance_types",
|
|
"description": "A place holder for a list of used cloud compute instance types",
|
|
"collection": "previously_seen_cloud_compute_instance_types",
|
|
"fields_list": "_key, firstTimeSeen, lastTimeSeen, instance_type, enough_data"
|
|
},
|
|
{
|
|
"name": "previously_seen_cloud_instance_modifications_by_user",
|
|
"description": "A table of users seen making instance modifications, and the first and last time that the activity was observed",
|
|
"collection": "previously_seen_cloud_instance_modifications_by_user",
|
|
"fields_list": "_key, firstTimeSeen, lastTimeSeen, user, enough_data"
|
|
},
|
|
{
|
|
"name": "previously_seen_cloud_provisioning_activity_sources",
|
|
"description": "A table of source IPs, geographic locations, and the first and last time that they have that done cloud provisioning activities",
|
|
"collection": "previously_seen_cloud_provisioning_activity_sources",
|
|
"fields_list": "_key, src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data"
|
|
},
|
|
{
|
|
"name": "previously_seen_cloud_regions",
|
|
"description": "A table of vendor_region values and the first and last time that they have been observed in cloud provisioning activities",
|
|
"collection": "previously_seen_cloud_regions",
|
|
"fields_list": "_key, firstTimeSeen, lastTimeSeen, vendor_region, enough_data"
|
|
},
|
|
{
|
|
"name": "previously_seen_cmd_line_arguments",
|
|
"description": "A placeholder for a list of cmd line arugments that been seen before",
|
|
"filename": "previously_seen_cmd_line_arguments.csv"
|
|
},
|
|
{
|
|
"name": "previously_seen_ec2_modifications_by_user",
|
|
"description": "A place holder for a list of AWS EC2 modifications done by each user",
|
|
"filename": "previously_seen_ec2_modifications_by_user.csv"
|
|
},
|
|
{
|
|
"name": "previously_seen_gcp_storage_access_from_remote_ip",
|
|
"description": "A place holder for a list of GCP storage access from remote IPs",
|
|
"filename": "previously_seen_gcp_storage_access_from_remote_ip.csv",
|
|
"default_match": "false",
|
|
"min_matches": 1
|
|
},
|
|
{
|
|
"name": "previously_seen_running_windows_services",
|
|
"description": "A placeholder for the list of Windows Services running",
|
|
"collection": "previously_seen_running_windows_services",
|
|
"fields_list": "_key, service, firstTimeSeen, lastTimeSeen"
|
|
},
|
|
{
|
|
"name": "previously_seen_users_console_logins",
|
|
"description": "A table of users seen doing console logins, and the first and last time that the activity was observed",
|
|
"collection": "previously_seen_users_console_logins",
|
|
"fields_list": "_key, firstTime, lastTime, user, src, City, Region, Country"
|
|
},
|
|
{
|
|
"name": "prohibited_apps_launching_cmd",
|
|
"description": "A list of processes that should not be launching cmd.exe",
|
|
"filename": "prohibited_apps_launching_cmd.csv",
|
|
"match_type": "WILDCARD(prohibited_applications)"
|
|
},
|
|
{
|
|
"name": "prohibited_processes",
|
|
"description": "A list of processes that have been marked as prohibited",
|
|
"filename": "prohibited_processes.csv"
|
|
},
|
|
{
|
|
"name": "prohibited_softwares",
|
|
"description": "A list of processes that have been marked as prohibited",
|
|
"filename": "prohibited_softwares.csv"
|
|
},
|
|
{
|
|
"name": "ransomware_extensions_lookup",
|
|
"description": "A list of file extensions that are associated with ransomware",
|
|
"filename": "ransomware_extensions.csv",
|
|
"default_match": "false",
|
|
"match_type": "WILDCARD(Extensions)",
|
|
"min_matches": 1,
|
|
"case_sensitive_match": "false"
|
|
},
|
|
{
|
|
"name": "ransomware_notes_lookup",
|
|
"description": "A list of file names that are ransomware note files",
|
|
"filename": "ransomware_notes.csv",
|
|
"default_match": "false",
|
|
"match_type": "WILDCARD(ransomware_notes)",
|
|
"min_matches": 1
|
|
},
|
|
{
|
|
"name": "s3_deletion_baseline",
|
|
"description": "A placeholder for the baseline information for AWS S3 deletions",
|
|
"filename": "s3_deletion_baseline.csv"
|
|
},
|
|
{
|
|
"name": "security_group_activity_baseline",
|
|
"description": "A placeholder for the baseline information for AWS security groups",
|
|
"filename": "security_group_activity_baseline.csv"
|
|
},
|
|
{
|
|
"name": "security_services_lookup",
|
|
"description": "A list of services that deal with security",
|
|
"filename": "security_services.csv",
|
|
"default_match": "false",
|
|
"match_type": "WILDCARD(service)",
|
|
"min_matches": 1
|
|
},
|
|
{
|
|
"name": "suspicious_writes_lookup",
|
|
"description": "A list of suspicious file names",
|
|
"filename": "suspicious_files.csv",
|
|
"default_match": "false",
|
|
"match_type": "WILDCARD(file)",
|
|
"min_matches": 1
|
|
},
|
|
{
|
|
"name": "zoom_first_time_child_process",
|
|
"description": "A list of suspicious file names",
|
|
"collection": "zoom_first_time_child_process",
|
|
"fields_list": "_key, dest, process_name, firstTimeSeen, lastTimeSeen"
|
|
}
|
|
] |