mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
1254 lines
56 KiB
Plaintext
1254 lines
56 KiB
Plaintext
#############
|
|
# Automatically generated by generator.py in splunk/security-content
|
|
# On Date: 2020-10-14T07:25:08 UTC
|
|
# Author: Splunk Security Research
|
|
# Contact: research@splunk.com
|
|
#############
|
|
|
|
|
|
[aws_cloudwatchlogs_eks]
|
|
definition = sourcetype="aws:cloudwatchlogs:eks"
|
|
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
|
|
|
[aws_cross_account_activity_from_previously_unseen_account___dm_filter]
|
|
definition = search *
|
|
description = Use this macro to add additional filters
|
|
|
|
[aws_s3_accesslogs]
|
|
definition = sourcetype=aws:s3:accesslogs
|
|
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
|
|
|
[aws_securityhub_firehose]
|
|
definition = sourcetype="aws:securityhub:firehose"
|
|
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
|
|
|
[brand_abuse_dns]
|
|
definition = lookup update=true brandMonitoring_lookup domain as query OUTPUT domain_abuse | search domain_abuse=true
|
|
description = This macro limits the output to only domains that are in the brand monitoring lookup file
|
|
|
|
[brand_abuse_email]
|
|
definition = lookup update=true brandMonitoring_lookup domain as src_user OUTPUT domain_abuse | search domain_abuse=true
|
|
description = This macro limits the output to only domains that are in the brand monitoring lookup file
|
|
|
|
[brand_abuse_web]
|
|
definition = lookup update=true brandMonitoring_lookup domain as urls OUTPUT domain_abuse | search domain_abuse=true
|
|
description = This macro limits the output to only domains that are in the brand monitoring lookup file
|
|
|
|
[cisco_networks]
|
|
definition = eventtype=cisco_ios
|
|
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
|
|
|
[clients_connecting_to_multiple_dns_servers_output_filter]
|
|
definition = search *
|
|
description = Use this macro to add additional filters for monitoring clients connecting to multiple dns servers
|
|
|
|
[cloudtrail]
|
|
definition = sourcetype=aws:cloudtrail
|
|
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
|
|
|
[cloudwatch_eks]
|
|
definition = sourcetype="aws:cloudwatchlogs:eks"
|
|
description = customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch eks logs. Replace the macro definition with configurations for your Splunk Environmnent.
|
|
|
|
[cloudwatch_vpc]
|
|
definition = sourcetype=aws:cloudwatchlogs:vpcflow
|
|
description = customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch vpc logs. Replace the macro definition with configurations for your Splunk Environmnent.
|
|
|
|
[cloudwatchlogs_vpcflow]
|
|
definition = sourcetype=aws:cloudwatchlogs:vpcflow
|
|
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
|
|
|
[create_or_delete_windows_shares_filter]
|
|
definition = search *
|
|
description = Use this macro to add additional filter for create or delete windows shares
|
|
|
|
[detect_arp_poisoning_filter]
|
|
definition = search *
|
|
description = Use this macro to add additional filters to prevent i.e. false positives
|
|
|
|
[detect_new_user_aws_console_login___dm_filter]
|
|
definition = search *
|
|
description = Use this macro to add additional filters
|
|
|
|
[detect_rogue_dhcp_server_filter]
|
|
definition = search *
|
|
description = Use this macro to add additional filters to prevent i.e. false positives
|
|
|
|
[detect_zerologon_via_zeek_filter]
|
|
definition = search *
|
|
description = Use this macro to add additional filters
|
|
|
|
[dynamic_dns_providers]
|
|
definition = lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True
|
|
description = This macro limits the output of the query field to dynamic dns domains. It looks up the domains in a file provided by Splunk and one intended to be updated by the end user.
|
|
|
|
[dynamic_dns_web_traffic]
|
|
definition = lookup update=true dynamic_dns_providers_default dynamic_dns_domains as url OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as url OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True
|
|
description = This is a description
|
|
|
|
[ec2_excessive_runinstances_mltk_input_filter]
|
|
definition = search *
|
|
description = Use this macro to add additional filters
|
|
|
|
[ec2_excessive_terminateinstances_mltk_input_filter]
|
|
definition = search *
|
|
description = Use this macro to add additional filters
|
|
|
|
[ec2_modification_api_calls]
|
|
definition = (eventName=AssociateAddress OR eventName=AssociateIamInstanceProfile OR eventName=AttachClassicLinkVpc OR eventName=AttachNetworkInterface OR eventName=AttachVolume OR eventName=BundleInstance OR eventName=DetachClassicLinkVpc OR eventName=DetachVolume OR eventName=GetConsoleOutput OR eventName=GetConsoleScreenshot OR eventName=ModifyInstanceAttribute OR eventName=ModifyInstancePlacement OR eventName=MonitorInstances OR eventName=RebootInstances OR eventName=ResetInstanceAttribute OR eventName=StartInstances OR eventName=StopInstances OR eventName=TerminateInstances OR eventName=UnmonitorInstances)
|
|
description = This is a list of AWS event names that have to do with modifying Amazon EC2 instances
|
|
|
|
[evilginx_phishlets_0365]
|
|
definition = (query=login* AND query=www*)
|
|
description = This limits the query fields to domains that are associated with evilginx masquerading as Office 365
|
|
|
|
[evilginx_phishlets_amazon]
|
|
definition = (query=fls-na* AND query = www* AND query=images*)
|
|
description = This limits the query fields to domains that are associated with evilginx masquerading as Amazon
|
|
|
|
[evilginx_phishlets_aws]
|
|
definition = (query=www* AND query=aws* AND query=console.aws* AND query=signin.aws* AND api-northeast-1.console.aws* AND query=fls-na* AND query=images-na*)
|
|
description = This limits the query fields to domains that are associated with evilginx masquerading as an AWS console
|
|
|
|
[evilginx_phishlets_facebook]
|
|
definition = (query=www* AND query = m* AND query=static*)
|
|
description = This limits the query fields to domains that are associated with evilginx masquerading as FaceBook
|
|
|
|
[evilginx_phishlets_github]
|
|
definition = (query=api* AND query = github*)
|
|
description = This limits the query fields to domains that are associated with evilginx masquerading as GitHub
|
|
|
|
[evilginx_phishlets_google]
|
|
definition = (query=accounts* AND query=ssl* AND query=www*)
|
|
description = This limits the query fields to domains that are associated with evilginx masquerading as Google
|
|
|
|
[evilginx_phishlets_outlook]
|
|
definition = (query=outlook* AND query=login* AND query=account*)
|
|
description = This limits the query fields to domains that are associated with evilginx masquerading as Outlook
|
|
|
|
[f5_bigip_rogue]
|
|
definition = index=netops sourcetype="f5:bigip:rogue"
|
|
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
|
|
|
[filter_rare_process_whitelist]
|
|
definition = lookup update=true lookup_rare_process_whitelist_default process as process OUTPUTNEW whitelist | where whitelist="false" | lookup update=true lookup_rare_process_whitelist_local process as process OUTPUT whitelist | where whitelist="false"
|
|
description = This macro is intended to whitelist processes that have been definied as rare
|
|
|
|
[google_gcp_pubnet_message]
|
|
definition = sourcetype="google:gcp:pubsub:message"
|
|
description = customer specific splunk configurations(eg- index, source, sourcetype) for Google GCP. Replace the macro definition with configurations for your Splunk Environmnent.
|
|
|
|
[google_gcp_pubsub_message]
|
|
definition = sourcetype="google:gcp:pubsub:message"
|
|
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
|
|
|
[is_windows_system_file]
|
|
definition = lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true
|
|
description = This macro limits the output to process names that are in the Windows System directory
|
|
|
|
[kubernetes_azure]
|
|
definition = sourcetype=mscs:storage:blob:json
|
|
description = customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data from Azure. Replace the macro definition with configurations for your Splunk Environmnent.
|
|
|
|
[kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter]
|
|
definition = search *
|
|
description = Use this macro to add additional filters
|
|
|
|
[kubernetes_azure_detect_rbac_authorization_by_account_filter]
|
|
definition = search *
|
|
description = Use this macro to add additional filters
|
|
|
|
[kubernetes_azure_detect_sensitive_object_access_filter]
|
|
definition = search *
|
|
description = Use this macro to add additional filters
|
|
|
|
[kubernetes_azure_detect_sensitive_role_access_filter]
|
|
definition = search *
|
|
description = Use this macro to add additional filters
|
|
|
|
[kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter]
|
|
definition = search *
|
|
description = Use this macro to add additional filters
|
|
|
|
[kubernetes_azure_detect_suspicious_kubectl_calls_filter]
|
|
definition = search *
|
|
description = Use this macro to add additional filters
|
|
|
|
[kubernetes_azure_pod_scan_fingerprint_detection_filter]
|
|
definition = search *
|
|
description = Use this macro to add additional filters
|
|
|
|
[kubernetes_azure_scan_fingerprint_filter]
|
|
definition = search *
|
|
description = Use this macro to add additional filters
|
|
|
|
[netbackup]
|
|
definition = sourcetype="netbackup_logs"
|
|
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
|
|
|
[network_acl_events]
|
|
definition = (eventName = CreateNetworkAcl OR eventName = CreateNetworkAclEntry OR eventName = DeleteNetworkAcl OR eventName = DeleteNetworkAclEntry OR eventName = ReplaceNetworkAclEntry OR eventName = ReplaceNetworkAclAssociation)
|
|
description = This is a list of AWS event names that are associated with Network ACLs
|
|
|
|
[okta]
|
|
definition = eventtype=okta_log
|
|
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
|
|
|
[previously_seen_cloud_compute_creations_by_user_input_filter]
|
|
definition = search *
|
|
description = Use this macro to add additional filters
|
|
|
|
[previously_seen_cloud_compute_creations_by_user_search_window_begin_offset]
|
|
definition = -70m@m
|
|
description = Use this macro to determine how far into the past the window should be to determine if the user is new or not
|
|
|
|
[previously_seen_cloud_compute_image_input_filter]
|
|
definition = search *
|
|
description = Use this macro to add additional filters
|
|
|
|
[previously_seen_cloud_compute_image_search_window_begin_offset]
|
|
definition = -70m@m
|
|
description = Use this macro to determine how far into the past the window should be to determine if the image is new or not
|
|
|
|
[previously_seen_cloud_compute_instance_types_input_filter]
|
|
definition = search *
|
|
description = Use this macro to add additional filters
|
|
|
|
[previously_seen_cloud_compute_instance_types_search_window_begin_offset]
|
|
definition = -70m@m
|
|
description = Use this macro to determine how far into the past the window should be to determine if the instance type is new or not
|
|
|
|
[previously_seen_cloud_regions_input_filter]
|
|
definition = search *
|
|
description = Use this macro to add additional filters
|
|
|
|
[previously_seen_cloud_regions_search_window_begin_offset]
|
|
definition = -70m@m
|
|
description = Use this macro to determine how far into the past the window should be to determine if the region is new or not
|
|
|
|
[previously_seen_windows_service_window]
|
|
definition = -70m@m
|
|
description = Use this macro to determine how far back you should be checking for new Windows services
|
|
|
|
[previously_seen_windows_services_forget_window]
|
|
definition = -90d@d
|
|
description = Use this macro to determine how long to keep track of Windows services
|
|
|
|
[previously_seen_zoom_child_processes_forget_window]
|
|
definition = -90d@d
|
|
description = Use this macro to determine how long to keep track of zoom child processes
|
|
|
|
[previously_seen_zoom_child_processes_window]
|
|
definition = -70m@m
|
|
description = Use this macro to determine how far back you should be checking for new zoom child processes
|
|
|
|
[prohibited_apps_launching_cmd]
|
|
definition = | inputlookup prohibited_apps_launching_cmd | rename prohibited_applications as parent_process_name | eval parent_process_name="*" . parent_process_name | table parent_process_name
|
|
description = This macro outputs a list of process that should not be the parent process of cmd.exe
|
|
|
|
[prohibited_softwares]
|
|
definition = lookup interesting_processes_lookup app as process_name OUTPUT is_prohibited | search is_prohibited=True
|
|
description = This macro limits the output to process_names that have been marked as prohibited
|
|
|
|
[ransomware_extensions]
|
|
definition = lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Name | search Name !=False
|
|
description = This macro limits the output to files that have extensions associated with ransomware
|
|
|
|
[ransomware_notes]
|
|
definition = lookup ransomware_notes_lookup ransomware_notes as file_name OUTPUT status as "Known Ransomware Notes" | search "Known Ransomware Notes"=True
|
|
description = This macro limits the output to files that have been identified as a ransomware note
|
|
|
|
[remove_valid_domains]
|
|
definition = eval domain=trim(domain,"*") | search NOT[| inputlookup domains] NOT[ |inputlookup cim_corporate_email_domain_lookup] NOT[inputlookup cim_corporate_web_domain_lookup] | eval domain="*"+domain+"*"
|
|
description = This macro removes valid domains from the output
|
|
|
|
[s3_accesslogs]
|
|
definition = sourcetype=aws:s3:accesslogs
|
|
description = customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch vpc logs. Replace the macro definition with configurations for your Splunk Environmnent.
|
|
|
|
[security_content_ctime(1)]
|
|
args = field
|
|
definition = convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)
|
|
description = convert epoch time to string
|
|
|
|
[security_content_summariesonly]
|
|
definition = summariesonly=false allow_old_summaries=true
|
|
description = search data model's summaries only
|
|
|
|
[security_group_api_calls]
|
|
definition = (eventName=AuthorizeSecurityGroupIngress OR eventName=CreateSecurityGroup OR eventName=DeleteSecurityGroup OR eventName=DescribeClusterSecurityGroups OR eventName=DescribeDBSecurityGroups OR eventName=DescribeSecurityGroupReferences OR eventName=DescribeSecurityGroups OR eventName=DescribeStaleSecurityGroups OR eventName=RevokeSecurityGroupIngress OR eventName=UpdateSecurityGroupRuleDescriptionsIngress)
|
|
description = This macro is a list of AWS event names associated with security groups
|
|
|
|
[stream_dns]
|
|
definition = sourcetype=stream:dns
|
|
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
|
|
|
[stream_http]
|
|
definition = sourcetype=stream:http
|
|
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
|
|
|
[stream_tcp]
|
|
definition = sourcetype=stream:tcp
|
|
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
|
|
|
[suspicious_email_attachments]
|
|
definition = lookup update=true is_suspicious_file_extension_lookup file_name OUTPUT suspicious | search suspicious=true
|
|
description = This macro limits the output to email attachments that have suspicious extensions
|
|
|
|
[suspicious_writes]
|
|
definition = lookup suspicious_writes_lookup file as file_name OUTPUT note as "Reference" | search "Reference" != False
|
|
description = This macro limites the output to file names that have been marked as suspicious
|
|
|
|
[sysmon]
|
|
definition = sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
|
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
|
|
|
[system_network_configuration_discovery_tools]
|
|
definition = (process_name= "arp.exe" OR process_name= "at.exe" OR process_name= "attrib.exe" OR process_name= "cscript.exe" OR process_name= "dsquery.exe" OR process_name= "hostname.exe" OR process_name= "ipconfig.exe" OR process_name= "mimikatz.exe" OR process_name= "nbstat.exe" OR process_name= "net.exe" OR process_name= "netsh.exe" OR process_name= "nslookup.exe" OR process_name= "ping.exe" OR process_name= "quser.exe" OR process_name= "qwinsta.exe" OR process_name= "reg.exe" OR process_name= "runas.exe" OR process_name= "sc.exe" OR process_name= "schtasks.exe" OR process_name= "ssh.exe" OR process_name= "systeminfo.exe" OR process_name= "taskkill.exe" OR process_name= "telnet.exe" OR process_name= "tracert.exe" OR process_name="wscript.exe" OR process_name= "xcopy.exe")
|
|
description = This macro is a list of process that can be used to discover the network configuration
|
|
|
|
[uncommon_processes]
|
|
definition = lookup update=true lookup_uncommon_processes_default process_name as process_name outputnew uncommon_default,category_default,analytic_story_default,kill_chain_phase_default,mitre_attack_default | lookup update=true lookup_uncommon_processes_local process_name as process_name outputnew uncommon_local,category_local,analytic_story_local,kill_chain_phase_local,mitre_attack_local | eval uncommon = coalesce(uncommon_default, uncommon_local), analytic_story = coalesce(analytic_story_default, analytic_story_local), category=coalesce(category_default, category_local), kill_chain_phase=coalesce(kill_chain_phase_default, kill_chain_phase_local), mitre_attack=coalesce(mitre_attack_default, mitre_attack_local) | fields - analytic_story_default, analytic_story_local, category_default, category_local, kill_chain_phase_default, kill_chain_phase_local, mitre_attack_default, mitre_attack_local, uncommon_default, uncommon_local | search uncommon=true
|
|
description = This macro limits the output to processes that have been marked as uncommon
|
|
|
|
[wineventlog_security]
|
|
definition = eventtype=wineventlog_security
|
|
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
|
|
|
[wineventlog_system]
|
|
definition = eventtype=wineventlog_system
|
|
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
|
|
|
[wmi]
|
|
definition = sourcetype="wineventlog:microsoft-windows-wmi-activity/operational"
|
|
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
|
|
|
[zeek_rpc]
|
|
definition = index=zeek sourcetype="zeek:rpc:json"
|
|
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
|
|
|
|
[aws_cloud_provisioning_from_previously_unseen_city_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[aws_cloud_provisioning_from_previously_unseen_country_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[aws_cloud_provisioning_from_previously_unseen_ip_address_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[aws_cloud_provisioning_from_previously_unseen_region_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[aws_cross_account_activity_from_previously_unseen_account_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[aws_eks_kubernetes_cluster_sensitive_object_access_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[aws_network_access_control_list_created_with_all_open_ports_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[aws_network_access_control_list_deleted_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[abnormally_high_aws_instances_launched_by_user_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[abnormally_high_aws_instances_launched_by_user___mltk_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[abnormally_high_aws_instances_terminated_by_user_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[abnormally_high_aws_instances_terminated_by_user___mltk_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[access_lsass_memory_for_dump_creation_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[amazon_eks_kubernetes_pod_scan_detection_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[amazon_eks_kubernetes_cluster_scan_detection_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[attempt_to_add_certificate_to_untrusted_store_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[attempt_to_stop_security_service_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[attempted_credential_dump_from_registry_via_reg_exe_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[batch_file_write_to_system32_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[child_processes_of_spoolsv_exe_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[clients_connecting_to_multiple_dns_servers_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[cloud_compute_instance_created_by_previously_unseen_user_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[cloud_compute_instance_created_with_previously_unseen_image_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[cloud_compute_instance_created_with_previously_unseen_instance_type_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[cloud_compute_instance_started_in_previously_unused_region_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[common_ransomware_extensions_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[common_ransomware_notes_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[create_remote_thread_into_lsass_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[create_local_admin_accounts_using_net_exe_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[create_or_delete_windows_shares_using_net_exe_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[creation_of_shadow_copy_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[creation_of_shadow_copy_with_wmic_and_powershell_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[credential_dumping_via_copy_command_from_shadow_copy_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[credential_dumping_via_symlink_to_shadow_copy_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[dns_query_length_outliers___mltk_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[dns_query_length_with_high_standard_deviation_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[dns_query_requests_resolved_by_unauthorized_dns_servers_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[dns_record_changed_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[deleting_shadow_copies_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_api_activity_from_users_without_mfa_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_arp_poisoning_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_aws_api_activities_from_unapproved_accounts_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_aws_console_login_by_user_from_new_city_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_aws_console_login_by_user_from_new_country_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_aws_console_login_by_user_from_new_region_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_activity_related_to_pass_the_hash_attacks_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_computer_changed_with_anonymous_account_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_credential_dumping_through_lsass_access_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_excessive_account_lockouts_from_endpoint_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_excessive_user_account_lockouts_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_f5_tmui_rce_cve_2020_5902_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_gcp_storage_access_from_a_new_ip_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_large_outbound_icmp_packets_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_long_dns_txt_record_response_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_mimikatz_using_loaded_images_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_mimikatz_via_powershell_and_eventcode_4703_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_new_local_admin_account_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_new_login_attempts_to_routers_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_new_open_gcp_storage_buckets_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_new_open_s3_buckets_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_oulook_exe_writing_a__zip_file_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_outbound_smb_traffic_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_path_interception_by_creation_of_program_exe_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_prohibited_applications_spawning_cmd_exe_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_psexec_with_accepteula_flag_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_rare_executables_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_rogue_dhcp_server_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_s3_access_from_a_new_ip_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_spike_in_aws_api_activity_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_spike_in_aws_security_hub_alerts_for_user_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_spike_in_network_acl_activity_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_spike_in_s3_bucket_deletion_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_spike_in_security_group_activity_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_spike_in_blocked_outbound_traffic_from_your_aws_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_usb_device_insertion_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_unauthorized_assets_by_mac_address_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_use_of_cmd_exe_to_launch_script_interpreters_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_windows_dns_sigred_via_splunk_stream_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_windows_dns_sigred_via_zeek_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_zerologon_via_zeek_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_attackers_scanning_for_vulnerable_jboss_servers_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_hosts_connecting_to_dynamic_domain_providers_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_malicious_requests_to_exploit_jboss_servers_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_mshta_exe_running_scripts_in_command_line_arguments_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_new_api_calls_from_user_roles_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_new_user_aws_console_login_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_new_user_aws_console_login___dm_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_processes_used_for_system_network_configuration_discovery_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detect_web_traffic_to_dynamic_domain_providers_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detection_of_dns_tunnels_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[detection_of_tools_built_by_nirsoft_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[disabling_remote_user_account_control_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[dump_lsass_via_comsvcs_dll_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[ec2_instance_modified_with_previously_unseen_user_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[ec2_instance_started_in_previously_unseen_region_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[ec2_instance_started_with_previously_unseen_ami_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[ec2_instance_started_with_previously_unseen_instance_type_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[ec2_instance_started_with_previously_unseen_user_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[email_attachments_with_lots_of_spaces_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[email_files_written_outside_of_the_outlook_directory_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[email_servers_sending_high_volume_traffic_to_hosts_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[excessive_dns_failures_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[execution_of_file_with_spaces_before_extension_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[execution_of_file_with_multiple_extensions_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[extended_period_without_successful_netbackup_backups_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[file_with_samsam_extension_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[first_time_seen_child_process_of_zoom_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[first_time_seen_running_windows_service_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[first_time_seen_command_line_argument_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[gcp_gcr_container_uploaded_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[gcp_kubernetes_cluster_pod_scan_detection_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[gcp_kubernetes_cluster_scan_detection_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[hiding_files_and_directories_with_attrib_exe_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[hosts_receiving_high_volume_of_network_traffic_from_email_server_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[identify_new_user_accounts_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[kerberoasting_spn_request_with_rc4_encryption_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[kubernetes_aws_detect_rbac_authorization_by_account_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[kubernetes_aws_detect_most_active_service_accounts_by_pod_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[kubernetes_aws_detect_sensitive_role_access_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[kubernetes_aws_detect_service_accounts_forbidden_failure_access_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[kubernetes_aws_detect_suspicious_kubectl_calls_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[kubernetes_azure_detect_rbac_authorization_by_account_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[kubernetes_azure_detect_sensitive_object_access_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[kubernetes_azure_detect_sensitive_role_access_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[kubernetes_azure_detect_suspicious_kubectl_calls_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[kubernetes_azure_pod_scan_fingerprint_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[kubernetes_azure_scan_fingerprint_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[kubernetes_gcp_detect_rbac_authorizations_by_account_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[kubernetes_gcp_detect_sensitive_object_access_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[kubernetes_gcp_detect_sensitive_role_access_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[kubernetes_gcp_detect_service_accounts_forbidden_failure_access_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[kubernetes_gcp_detect_suspicious_kubectl_calls_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[large_volume_of_dns_any_queries_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[macos___re_opened_applications_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[malicious_powershell_process___connect_to_internet_with_hidden_window_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[malicious_powershell_process___encoded_command_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[malicious_powershell_process___execution_policy_bypass_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[malicious_powershell_process___multiple_suspicious_command_line_arguments_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[malicious_powershell_process_with_obfuscation_techniques_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[monitor_dns_for_brand_abuse_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[monitor_email_for_brand_abuse_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[monitor_registry_keys_for_print_monitors_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[monitor_web_traffic_for_brand_abuse_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[multiple_okta_users_with_invalid_credentails_from_the_same_ip_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[new_container_uploaded_to_aws_ecr_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[no_windows_updates_in_a_time_frame_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[okta_account_lockout_events_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[okta_failed_sso_attempts_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[okta_user_logins_from_multiple_cities_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[open_redirect_in_splunk_web_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[osquery_pack___coldroot_detection_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[overwriting_accessibility_binaries_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[process_execution_via_wmi_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[processes_tapping_keyboard_events_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[processes_created_by_netsh_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[processes_launching_netsh_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[prohibited_network_traffic_allowed_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[prohibited_software_on_endpoint_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[protocol_or_port_mismatch_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[protocols_passing_authentication_in_cleartext_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[reg_exe_manipulating_windows_services_registry_keys_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[reg_exe_used_to_hide_files_directories_via_registry_keys_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[registry_keys_used_for_persistence_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[registry_keys_used_for_privilege_escalation_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[registry_keys_for_creating_shim_databases_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[remote_desktop_network_bruteforce_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[remote_desktop_network_traffic_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[remote_desktop_process_running_on_system_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[remote_process_instantiation_via_wmi_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[remote_registry_key_modifications_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[remote_wmi_command_attempt_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[rundll_loading_dll_by_ordinal_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[smb_traffic_spike_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[smb_traffic_spike___mltk_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[sql_injection_with_long_urls_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[samsam_test_file_write_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[sc_exe_manipulating_windows_services_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[scheduled_task_name_used_by_dragonfly_threat_actors_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[scheduled_tasks_used_in_badrabbit_ransomware_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[schtasks_scheduling_job_on_remote_system_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[schtasks_used_for_forcing_a_reboot_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[script_execution_via_wmi_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[shim_database_file_creation_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[shim_database_installation_with_suspicious_parameters_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[short_lived_windows_accounts_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[single_letter_process_on_endpoint_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[spectre_and_meltdown_vulnerable_systems_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[spike_in_file_writes_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[splunk_enterprise_information_disclosure_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[suspicious_changes_to_file_associations_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[suspicious_email___uba_anomaly_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[suspicious_email_attachment_extensions_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[suspicious_file_write_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[suspicious_java_classes_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[suspicious_lnk_file_launching_a_process_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[suspicious_reg_exe_process_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[suspicious_wevtutil_usage_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[suspicious_writes_to_system_volume_information_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[suspicious_writes_to_windows_recycle_bin_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[system_information_discovery_detection_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[system_processes_run_from_unexpected_locations_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[tor_traffic_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[usn_journal_deletion_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[uncommon_processes_on_endpoint_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[unload_sysmon_filter_driver_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[unsigned_image_loaded_by_lsass_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[unsuccessful_netbackup_backups_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[unusually_long_command_line_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[unusually_long_command_line___mltk_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[unusually_long_content_type_length_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[wmi_permanent_event_subscription_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[wmi_permanent_event_subscription___sysmon_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[wmi_temporary_event_subscription_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[web_fraud___account_harvesting_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[web_fraud___anomalous_user_clickspeed_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[web_fraud___password_sharing_across_accounts_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[web_servers_executing_suspicious_processes_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[windows_event_log_cleared_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[windows_hosts_file_modification_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[aws_detect_attach_to_role_policy_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[aws_detect_permanent_key_creation_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[aws_detect_role_creation_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[aws_detect_sts_assume_role_abuse_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[aws_detect_sts_get_session_token_abuse_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|
|
[gcp_detect_oauth_token_abuse_filter]
|
|
definition = search *
|
|
description = Update this macro to limit the output results to filter out false positives.
|
|
|