mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
161 lines
12 KiB
Plaintext
161 lines
12 KiB
Plaintext
#############
|
|
# Automatically generated by generator.py in splunk/security-content
|
|
# On Date: 2019-11-05T20:22:49 UTC
|
|
# Author: Splunk Security Research
|
|
# Contact: research@splunk.com
|
|
#############
|
|
|
|
[NetworkACLEvents]
|
|
definition = (eventName = CreateNetworkAcl OR eventName = CreateNetworkAclEntry OR eventName = DeleteNetworkAcl OR eventName = DeleteNetworkAclEntry OR eventName = ReplaceNetworkAclEntry OR eventName = ReplaceNetworkAclAssociation)
|
|
description = This is a list of AWS event names that are associated with Network ACLs
|
|
|
|
[brand_abuse_dns]
|
|
definition = lookup update=true brandMonitoring_lookup domain as query OUTPUT domain_abuse | search domain_abuse=true
|
|
description = This macro limits the output to only domains that are in the brand monitoring lookup file
|
|
|
|
[brand_abuse_email]
|
|
definition = lookup update=true brandMonitoring_lookup domain as src_user OUTPUT domain_abuse | search domain_abuse=true
|
|
description = This macro limits the output to only domains that are in the brand monitoring lookup file
|
|
|
|
[brand_abuse_web]
|
|
definition = lookup update=true brandMonitoring_lookup domain as urls OUTPUT domain_abuse | search domain_abuse=true
|
|
description = This macro limits the output to only domains that are in the brand monitoring lookup file
|
|
|
|
[dynamic_dns_providers]
|
|
definition = lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True
|
|
description = This macro limits the output of the query field to dynamic dns domains. It looks up the domains in a file provided by Splunk and one intended to be updated by the end user.
|
|
|
|
[dynamic_dns_web_traffic]
|
|
definition = lookup update=true dynamic_dns_providers_default dynamic_dns_domains as url OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as url OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True
|
|
description = This is a description
|
|
|
|
[ec2ModificationAPIs]
|
|
definition = (eventName=AssociateAddress OR eventName=AssociateIamInstanceProfile OR eventName=AttachClassicLinkVpc OR eventName=AttachNetworkInterface OR eventName=AttachVolume OR eventName=BundleInstance OR eventName=DetachClassicLinkVpc OR eventName=DetachVolume OR eventName=GetConsoleOutput OR eventName=GetConsoleScreenshot OR eventName=ModifyInstanceAttribute OR eventName=ModifyInstancePlacement OR eventName=MonitorInstances OR eventName=RebootInstances OR eventName=ResetInstanceAttribute OR eventName=StartInstances OR eventName=StopInstances OR eventName=TerminateInstances OR eventName=UnmonitorInstances)
|
|
description = This is a list of AWS event names that have to do with modifying Amazon EC2 instances
|
|
|
|
[evilginx_phishlets_0365]
|
|
definition = (query=login* AND query=www*)
|
|
description = This limits the query fields to domains that are associated with evilginx masquerading as Office 365
|
|
|
|
[evilginx_phishlets_amazon]
|
|
definition = (query=fls-na* AND query = www* AND query=images*)
|
|
description = This limits the query fields to domains that are associated with evilginx masquerading as Amazon
|
|
|
|
[evilginx_phishlets_aws]
|
|
definition = (query=www* AND query=aws* AND query=console.aws* AND query=signin.aws* AND api-northeast-1.console.aws* AND query=fls-na* AND query=images-na*)
|
|
description = This limits the query fields to domains that are associated with evilginx masquerading as an AWS console
|
|
|
|
[evilginx_phishlets_facebook]
|
|
definition = (query=www* AND query = m* AND query=static*)
|
|
description = This limits the query fields to domains that are associated with evilginx masquerading as FaceBook
|
|
|
|
[evilginx_phishlets_github]
|
|
definition = (query=api* AND query = github*)
|
|
description = This limits the query fields to domains that are associated with evilginx masquerading as GitHub
|
|
|
|
[evilginx_phishlets_google]
|
|
definition = (query=accounts* AND query=ssl* AND query=www*)
|
|
description = This limits the query fields to domains that are associated with evilginx masquerading as Google
|
|
|
|
[evilginx_phishlets_outlook]
|
|
definition = (query=outlook* AND query=login* AND query=account*)
|
|
description = This limits the query fields to domains that are associated with evilginx masquerading as Outlook
|
|
|
|
[filter_rare_process_whitelist]
|
|
definition = lookup update=true lookup_rare_process_whitelist_default process as process OUTPUTNEW whitelist | where whitelist="false" | lookup update=true lookup_rare_process_whitelist_local process as process OUTPUT whitelist | where whitelist="false"
|
|
description = This macro is intended to whitelist processes that have been definied as rare
|
|
|
|
[investigate_cloud_compute_instance_activities_output_filter]
|
|
definition = `comment("Use this macro to add additional filters for investigating cloud compute activties")`
|
|
description = Use this macro to add additional filters for investigating cloud compute activties
|
|
|
|
[investigate_user_activities_in_all_cloud_region_output_filter]
|
|
definition = `comment("Use this macro to add additional filters for investigating a specific user's cloud infrastructure activties in all cloud regions")`
|
|
description = Use this macro to add additional filters for investigating a specific user's cloud infrastructure activties in all cloud regions
|
|
|
|
[investigate_user_activities_in_single_cloud_region_output_filter]
|
|
definition = `comment("Use this macro to add additional filters for investigating a specific user's cloud infrastructure activties in a specific cloud regions")`
|
|
description = Use this macro to add additional filters for investigating a specific user's cloud infrastructure activties in a specific cloud regions
|
|
|
|
[isWindowsSystemFile]
|
|
definition = lookup update=true isWindowsSystemFile_lookup filename as process_name OUTPUT systemFile | search systemFile=true
|
|
description = This macro limits the output to process names that are in the Windows System directory
|
|
|
|
[previously_seen_cloud_compute_creations_by_user_input_filter]
|
|
definition = `comment("Use this macro to add additional filters for monitoring users that create cloud compute images")`
|
|
description = Use this macro to add additional filters for monitoring users that create cloud compute images
|
|
|
|
[previously_seen_cloud_compute_creations_by_user_search_window_begin_offset]
|
|
definition = -70m@m
|
|
description = Use this macro to determine how far into the past the window should be to determine if the user is new or not
|
|
|
|
[previously_seen_cloud_compute_image_input_filter]
|
|
definition = `comment("Use this macro to add additional filters for monitoring cloud compute images")`
|
|
description = Use this macro to add additional filters for monitoring cloud compute images
|
|
|
|
[previously_seen_cloud_compute_image_search_window_begin_offset]
|
|
definition = -70m@m
|
|
description = Use this macro to determine how far into the past the window should be to determine if the image is new or not
|
|
|
|
[previously_seen_cloud_compute_instance_types_input_filter]
|
|
definition = `comment("Use this macro to add additional filters for monitoring cloud compute instance types")`
|
|
description = Use this macro to add additional filters for monitoring cloud compute instance types
|
|
|
|
[previously_seen_cloud_compute_instance_types_search_window_begin_offset]
|
|
definition = -70m@m
|
|
description = Use this macro to determine how far into the past the window should be to determine if the instance type is new or not
|
|
|
|
[previously_seen_cloud_regions_input_filter]
|
|
definition = `comment("Use this macro to add additional filters for monitoring your cloud regions")`
|
|
description = Use this macro to add additional filters for monitoring your cloud regions
|
|
|
|
[previously_seen_cloud_regions_search_window_begin_offset]
|
|
definition = -70m@m
|
|
description = Use this macro to determine how far into the past the window should be to determine if the region is new or not
|
|
|
|
[prohibited_apps_launching_cmd]
|
|
definition = | inputlookup prohibited_apps_launching_cmd | rename prohibited_applications as parent_process_name | eval parent_process_name="*" . parent_process_name | table parent_process_name
|
|
description = This macro outputs a list of process that should not be the parent process of cmd.exe
|
|
|
|
[prohibited_softwares]
|
|
definition = lookup interesting_processes_lookup app as process_name OUTPUT is_prohibited | search is_prohibited=True
|
|
description = This macro limits the output to process_names that have been marked as prohibited
|
|
|
|
[ransomware_extensions]
|
|
definition = lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Name | search Name !=False
|
|
description = This macro limits the output to files that have extensions associated with ransomware
|
|
|
|
[ransomware_notes]
|
|
definition = lookup ransomware_notes_lookup ransomware_notes as file_name OUTPUT status as "Known Ransomware Notes" | search "Known Ransomware Notes"=True
|
|
description = This macro limits the output to files that have been identified as a ransomware note
|
|
|
|
[remove_valid_domains]
|
|
definition = eval domain=trim(domain,"*") | search NOT[| inputlookup domains] NOT[ |inputlookup cim_corporate_email_domain_lookup] NOT[inputlookup cim_corporate_web_domain_lookup] | eval domain="*"+domain+"*"
|
|
description = This macro removes valid domains from the output
|
|
|
|
[runstory(1)]
|
|
args = story_name
|
|
definition = runstory story=$story_name$ | table name, num_search_results, description, kill_chain_phases, mitre_attack
|
|
description = This macro takes an analytic story name and runs it
|
|
|
|
[securityGroupAPIs]
|
|
definition = (eventName=AuthorizeSecurityGroupIngress OR eventName=CreateSecurityGroup OR eventName=DeleteSecurityGroup OR eventName=DescribeClusterSecurityGroups OR eventName=DescribeDBSecurityGroups OR eventName=DescribeSecurityGroupReferences OR eventName=DescribeSecurityGroups OR eventName=DescribeStaleSecurityGroups OR eventName=RevokeSecurityGroupIngress OR eventName=UpdateSecurityGroupRuleDescriptionsIngress)
|
|
description = This macro is a list of AWS event names associated with security groups
|
|
|
|
[suspicious_email_attachments]
|
|
definition = lookup update=true isSuspiciousFileExtension_lookup file_name OUTPUT suspicious | search suspicious=true
|
|
description = This macro limits the output to email attachments that have suspicious extensions
|
|
|
|
[suspicious_writes]
|
|
definition = lookup suspicious_writes_lookup file as file_name OUTPUT note as "Reference" | search "Reference" != False
|
|
description = This macro limites the output to file names that have been marked as suspicious
|
|
|
|
[system_network_configuration_discovery_tools]
|
|
definition = (process_name= "arp.exe" OR process_name= "at.exe" OR process_name= "attrib.exe" OR process_name= "cscript.exe" OR process_name= "dsquery.exe" OR process_name= "hostname.exe" OR process_name= "ipconfig.exe" OR process_name= "mimikatz.exe" OR process_name= "nbstat.exe" OR process_name= "net.exe" OR process_name= "netsh.exe" OR process_name= "nslookup.exe" OR process_name= "ping.exe" OR process_name= "quser.exe" OR process_name= "qwinsta.exe" OR process_name= "reg.exe" OR process_name= "runas.exe" OR process_name= "sc.exe" OR process_name= "schtasks.exe" OR process_name= "ssh.exe" OR process_name= "systeminfo.exe" OR process_name= "taskkill.exe" OR process_name= "telnet.exe" OR process_name= "tracert.exe" OR process_name="wscript.exe" OR process_name= "xcopy.exe")
|
|
description = This macro is a list of process that can be used to discover the network configuration
|
|
|
|
[uncommon_processes]
|
|
definition = lookup update=true lookup_uncommon_processes_default process_name as process_name outputnew uncommon_default,category_default,analytic_story_default,kill_chain_phase_default,mitre_attack_default | lookup update=true lookup_uncommon_processes_local process_name as process_name outputnew uncommon_local,category_local,analytic_story_local,kill_chain_phase_local,mitre_attack_local | eval uncommon = coalesce(uncommon_default, uncommon_local), analytic_story = coalesce(analytic_story_default, analytic_story_local), category=coalesce(category_default, category_local), kill_chain_phase=coalesce(kill_chain_phase_default, kill_chain_phase_local), mitre_attack=coalesce(mitre_attack_default, mitre_attack_local) | fields - analytic_story_default, analytic_story_local, category_default, category_local, kill_chain_phase_default, kill_chain_phase_local, mitre_attack_default, mitre_attack_local, uncommon_default, uncommon_local | search uncommon=true
|
|
description = This macro limits the output to processes that have been marked as uncommon
|
|
|