Eric 58aca7db99 Update the deprecation_info.csv file, manually generated with a version of contentctl that has not yet been merged or released in main branch.

2025-03-18 15:41:21 -07:00

..

__mlspl_detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.mlmodel

Adding missing lookup files

2023-06-12 13:56:20 -07:00

__mlspl_detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml

first batch of updates to

2024-12-23 15:14:19 -08:00

__mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.mlmodel

adding detect suspicious dns txt records using pretrained model in dsdl

2023-01-17 15:26:01 -08:00

__mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml

first batch of updates to

2024-12-23 15:14:19 -08:00

__mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl.mlmodel

Detection name update

2023-02-07 15:31:48 +01:00

__mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml

first batch of updates to

2024-12-23 15:14:19 -08:00

__mlspl_pretrained_dga_model_dsdl.mlmodel

changing files

2022-09-28 12:36:40 -07:00

__mlspl_pretrained_dga_model_dsdl.yml

first batch of updates to

2024-12-23 15:14:19 -08:00

__mlspl_unusual_commandline_detection.mlmodel

Updating mlmodel to 5.3.x specification as well as the test apparatus

2022-01-25 21:42:16 -05:00

__mlspl_unusual_commandline_detection.yml

first batch of updates to

2024-12-23 15:14:19 -08:00

3cx_ioc_domains.csv

dns

2023-03-30 12:15:41 -06:00

3cx_ioc_domains.yml

first batch of updates to

2024-12-23 15:14:19 -08:00

ace_access_rights_lookup.csv

adding AD ACL and GPO related detections

2024-07-02 11:52:21 +10:00

ace_access_rights_lookup.yml

first batch of updates to

2024-12-23 15:14:19 -08:00

ace_flag_lookup.csv

adding AD ACL and GPO related detections

2024-07-02 11:52:21 +10:00

ace_flag_lookup.yml

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

ace_type_lookup.csv

adding AD ACL and GPO related detections

2024-07-02 11:52:21 +10:00

ace_type_lookup.yml

first batch of updates to

2024-12-23 15:14:19 -08:00

advanced_audit_policy_guids.csv

renaming advanced audit policy guids lookup

2023-02-13 12:03:49 -05:00

advanced_audit_policy_guids.yml

first batch of updates to

2024-12-23 15:14:19 -08:00

api_call_by_user_baseline.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

applockereventcodes.csv

ESCU Release Branch - v4.30.0

2024-04-17 20:44:56 +00:00

applockereventcodes.yml

first batch of updates to

2024-12-23 15:14:19 -08:00

asr_rules.csv

update: lookups with additional data

2025-01-30 20:33:48 +01:00

asr_rules.yml

update: lookups with additional data

2025-01-30 20:33:48 +01:00

attacker_tools.csv

spl duplicate and fixes

2023-07-28 14:34:00 -05:00

attacker_tools.yml

first batch of updates to

2024-12-23 15:14:19 -08:00

aws_service_accounts.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

aws_service_accounts.yml

first batch of updates to

2024-12-23 15:14:19 -08:00

baseline_blocked_outbound_connections.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

baseline_blocked_outbound_connections.yml

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

brandmonitoring_lookup.csv

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

brandmonitoring_lookup.yml

first batch of updates to

2024-12-23 15:14:19 -08:00

browser_app_list.csv

ESCU Release Branch v4.27.0

2024-03-20 20:01:18 +00:00

browser_app_list.yml

More cleanup of lookups

2024-12-23 16:06:48 -08:00

builtin_groups_lookup.csv

update: lookups with additional data

2025-01-30 20:33:48 +01:00

builtin_groups_lookup.yml

update: lookups with additional data

2025-01-30 20:33:48 +01:00

char_conversion_matrix.csv

Release 4.19.0

2024-01-10 17:21:34 +00:00

char_conversion_matrix.yml

More cleanup of lookups

2024-12-23 16:06:48 -08:00

cloud_instances_enough_data.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

decommissioned_buckets.yml

convert csv lookup to kvstore lookup.

2025-02-19 14:50:53 -08:00

deprecation_info.csv

Update the deprecation_info.csv file, manually generated with a version of contentctl that has not yet been merged or released in main branch.

2025-03-18 15:41:21 -07:00

deprecation_info.yml

updating lookups from latest mapping

2025-03-13 18:12:45 -07:00

discovered_dns_records.csv

app inspect failures fixes

2020-12-08 14:56:39 -08:00

discovered_dns_records.yml

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

domain_admins.csv

adding new detection - diamond ticket

2023-10-06 15:46:36 -04:00

domain_admins.yml

Second round of lookup file cleanup

2024-12-23 15:23:52 -08:00

domains.csv

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

domains.yml

Second round of lookup file cleanup

2024-12-23 15:23:52 -08:00

dynamic_dns_providers_default.csv

update: lookups with additional data

2025-01-30 20:33:48 +01:00

dynamic_dns_providers_default.yml

update: lookups with additional data

2025-01-30 20:33:48 +01:00

dynamic_dns_providers_local.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

dynamic_dns_providers_local.yml

Second round of lookup file cleanup

2024-12-23 15:23:52 -08:00

hijacklibs_loaded.csv

ESCU Release Branch v4.27.0

2024-03-20 20:01:18 +00:00

hijacklibs_loaded.yml

Second round of lookup file cleanup

2024-12-23 15:23:52 -08:00

hijacklibs.csv

T1003.001 Update

2022-08-25 08:04:20 -06:00

hijacklibs.yml

Second round of lookup file cleanup

2024-12-23 15:23:52 -08:00

images_to_repository.csv

updated detections

2021-09-06 10:59:00 +02:00

images_to_repository.yml

Second round of lookup file cleanup

2024-12-23 15:23:52 -08:00

is_net_windows_file.csv

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

is_net_windows_file.yml

Second round of lookup file cleanup

2024-12-23 15:23:52 -08:00

is_nirsoft_software.csv

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

is_nirsoft_software.yml

Second round of lookup file cleanup

2024-12-23 15:23:52 -08:00

is_suspicious_file_extension_lookup.csv

add additional suspicious file extensions

2020-11-18 16:19:11 -05:00

is_suspicious_file_extension_lookup.yml

Second round of lookup file cleanup

2024-12-23 15:23:52 -08:00

is_windows_system_file.csv

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

is_windows_system_file.yml

another round of lookup file updates

2024-12-23 15:45:58 -08:00

k8s_container_network_io_baseline.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

k8s_container_network_io_ratio_baseline.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

k8s_process_resource_baseline.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

k8s_process_resource_ratio_baseline.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

legit_domains.csv

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

legit_domains.yml

another round of lookup file updates

2024-12-23 15:45:58 -08:00

linux_tool_discovery_process.csv

combined the rest 2

2022-02-17 16:28:19 -08:00

linux_tool_discovery_process.yml

another round of lookup file updates

2024-12-23 15:45:58 -08:00

local_file_inclusion_paths.csv

new detection

2021-08-23 13:07:23 +02:00

local_file_inclusion_paths.yml

another round of lookup file updates

2024-12-23 15:45:58 -08:00

lolbas_file_path.csv

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

lolbas_file_path.yml

another round of lookup file updates

2024-12-23 15:45:58 -08:00

loldrivers.csv

Bespoke Drivers

2022-12-31 14:14:11 -07:00

loldrivers.yml

another round of lookup file updates

2024-12-23 15:45:58 -08:00

lookup_rare_process_allow_list_default.csv

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

lookup_rare_process_allow_list_default.yml

another round of lookup file updates

2024-12-23 15:45:58 -08:00

lookup_rare_process_allow_list_local.csv

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

lookup_rare_process_allow_list_local.yml

another round of lookup file updates

2024-12-23 15:45:58 -08:00

lookup_uncommon_processes_default.csv

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

lookup_uncommon_processes_default.yml

another round of lookup file updates

2024-12-23 15:45:58 -08:00

lookup_uncommon_processes_local.csv

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

lookup_uncommon_processes_local.yml

another round of lookup file updates

2024-12-23 15:45:58 -08:00

malicious_powershell_strings.csv

updating lookup

2025-03-03 16:20:52 -08:00

malicious_powershell_strings.yml

updating lookup

2025-03-03 16:20:52 -08:00

mandatory_job_for_workflow.csv

circle ci detecction

2021-09-02 10:42:01 +02:00

mandatory_job_for_workflow.yml

More cleanup of lookups

2024-12-23 16:06:48 -08:00

mandatory_step_for_job.csv

circle ci detecction

2021-09-01 17:54:38 +02:00

mandatory_step_for_job.yml

another round of lookup file updates

2024-12-23 15:45:58 -08:00

msad_guid_lookup.csv

adding AD ACL and GPO related detections

2024-07-02 11:52:21 +10:00

msad_guid_lookup.yml

another round of lookup file updates

2024-12-23 15:45:58 -08:00

network_acl_activity_baseline.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

network_acl_activity_baseline.yml

finish lookup cleanup

2025-01-03 11:05:52 -08:00

previously_seen_api_calls_from_user_roles.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_aws_cross_account_activity.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_aws_regions.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_cloud_api_calls_per_user_role.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_cloud_compute_creations_by_user.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_cloud_compute_images.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_cloud_compute_instance_types.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_cloud_instance_modifications_by_user.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_cloud_provisioning_activity_sources.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_cloud_regions.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_cmd_line_arguments.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

previously_seen_cmd_line_arguments.yml

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

previously_seen_ec2_amis_lookup.yml

Fix more errors with missing lookups, baselines, and detections

2025-01-16 10:45:46 -08:00

previously_seen_ec2_instance_types_lookup.yml

Fix more errors with missing lookups, baselines, and detections

2025-01-16 10:45:46 -08:00

previously_seen_ec2_launches_by_user_lookup.yml

Fix more errors with missing lookups, baselines, and detections

2025-01-16 10:45:46 -08:00

previously_seen_ec2_modifications_by_user.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

previously_seen_ec2_modifications_by_user.yml

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

previously_seen_gcp_storage_access_from_remote_ip.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_provisioning_activity_src.yml

progress on input/output lookup

2025-01-03 16:35:39 -08:00

previously_seen_running_windows_services.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_s3_access_from_remote_ip.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_users_console_logins.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

privileged_azure_ad_roles.csv

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

privileged_azure_ad_roles.yml

another round of lookup file updates

2024-12-23 15:45:58 -08:00

prohibited_apps_launching_cmd.csv

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

prohibited_apps_launching_cmd.yml

finish lookup cleanup

2025-01-03 11:05:52 -08:00

prohibited_processes.csv

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

prohibited_processes.yml

first batch of updates to

2024-12-23 15:14:19 -08:00

ransomware_extensions_lookup.csv

systembc

2025-03-03 14:12:55 +01:00

ransomware_extensions_lookup.yml

More cleanup of lookups

2024-12-23 16:06:48 -08:00

ransomware_notes_lookup.csv

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

ransomware_notes_lookup.yml

systembc

2025-03-03 15:10:33 +01:00

remote_access_software_exceptions.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

remote_access_software.csv

Update remote_access_software.csv

2025-02-10 16:12:12 -05:00

remote_access_software.yml

Update remote_access_software.yml

2025-02-10 11:06:56 -05:00

s3_deletion_baseline.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

security_group_activity_baseline.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

security_services_lookup.csv

update: lookups with additional data

2025-01-30 20:33:48 +01:00

security_services_lookup.yml

Update security_services_lookup.yml

2025-01-31 12:22:29 +01:00

suspicious_writes_lookup.csv

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

suspicious_writes_lookup.yml

another round of lookup file updates

2024-12-23 15:45:58 -08:00

windows_protocol_handlers.csv

Windows Protocol Handler

2022-07-12 14:43:39 -06:00

windows_protocol_handlers.yml

another round of lookup file updates

2024-12-23 15:45:58 -08:00

windows_suspicious_services.csv

Update windows_suspicious_services.csv

2025-02-19 15:29:33 -05:00

windows_suspicious_services.yml

Add files via upload

2025-02-07 14:26:58 -05:00

windows_suspicious_tasks.csv

Add files via upload

2025-02-07 13:34:34 -05:00

windows_suspicious_tasks.yml

Add files via upload

2025-02-07 13:34:34 -05:00

zoom_first_time_child_process.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00