splunk-security_content/package/default/macros.conf

#############
# Automatically generated by generator.py in splunk/security-content
# On Date: 2020-04-17T19:06:18 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############


[access_lsass_memory_for_dump_creation_filter]
definition = search *
description = Use this macro to add additional filters for access lsass memory for dump creation

[attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter]
definition = search *
description = Use this macro to add additional filter for attempt to set default powershell execution policy to unrestricted or bypass

[attempted_credential_dump_from_registry_via_reg_filter]
definition = search *
description = Use this macro to add additional filter for attempted credential dump from registry via reg

[attrib_to_hide_files_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[brand_abuse_dns]
definition = lookup update=true brandMonitoring_lookup domain as query OUTPUT domain_abuse | search domain_abuse=true
description = This macro limits the output to only domains that are in the brand monitoring lookup file

[brand_abuse_email]
definition = lookup update=true brandMonitoring_lookup domain as src_user OUTPUT domain_abuse | search domain_abuse=true
description = This macro limits the output to only domains that are in the brand monitoring lookup file

[brand_abuse_web]
definition = lookup update=true brandMonitoring_lookup domain as urls OUTPUT domain_abuse | search domain_abuse=true
description = This macro limits the output to only domains that are in the brand monitoring lookup file

[change_file_association_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[children_of_spoolsv_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[clients_connecting_to_multiple_dns_servers_output_filter]
definition = search *
description = Use this macro to add additional filters for monitoring clients connecting to multiple dns servers

[common_ransomware_extensions_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[common_ransomware_notes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[container_implant_aws_detection_filter]
definition = search *
description = Use this macro to add additional filters

[container_implant_gcp_detection_filter]
definition = search *
description = Use this macro to add additional filters

[create_local_admin_via_net_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[create_or_delete_windows_shares_filter]
definition = search *
description = Use this macro to add additional filter for create or delete windows shares

[create_remote_thread_into_lsass_filter]
definition = search *
description = Use this macro to add additional filter for create remote thread into lsass

[creation_of_shadow_copy_filter]
definition = search *
description = Use this macro to add additional filter for creation of shadow copy

[creation_of_shadow_copy_with_wmic_and_powershell_filter]
definition = search *
description = Use this macro to add additional filter for creation of shadow copy with wmic and powershell

[cred_dump_via_copy_from_shadowcopy_filter]
definition = search *
description = Use this macro to add additional filter for cred dump via copy from shadowcopy

[cred_dump_via_symlink_shadowcopy_filter]
definition = search *
description = Use this macro to add additional filter for cred dump via symlink shadowcopy

[detect_activity_related_to_pass_the_hash_attacks_filter]
definition = search *
description = Use this macro to add additional filters for detect activity related to pass the hash attacks

[detect_credential_dumping_through_LSASS_access_filter]
definition = search *
description = Use this macro to add additional filter for detect credential dumping through LSASS access

[detect_mimikatz_using_loaded_images_filter]
definition = search *
description = Use this macro to add additional filter for detect mimikatz using loaded images

[dns_query_length_mltk_filter]
definition = search *
description = Use this macro to add additional filters for monitoring DNS query length using MLTK

[dns_query_length_with_high_standard_deviation_filter]
definition = search *
description = Use this macro to add additional filters for monitoring DNS query length with high standard deviation

[dns_record_changed_filter]
definition = search *
description = Use this macro to add additional filters for monitoring DNS records changed

[dragonfly_schtasks_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[dump_lsass_via_comsvcs_dll_filter]
definition = search *
description = Use this macro to add additional filter for dump lsass via comsvcs dll filter

[dynamic_dns_providers]
definition = lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True
description = This macro limits the output of the query field to dynamic dns domains. It looks up the domains in a file provided by Splunk and one intended to be updated by the end user.

[dynamic_dns_web_traffic]
definition = lookup update=true dynamic_dns_providers_default dynamic_dns_domains as url OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as url OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True
description = This is a description

[ec2_excessive_runinstances_mltk_input_filter]
definition = search *
description = Use this macro to add additional filters for monitoring ec2 runinstances [eg - src_user != 'someUserNameExperiencingFalsePositives'].

[ec2_excessive_terminateinstances_mltk_input_filter]
definition = search *
description = Use this macro to add additional filters for monitoring ec2 terminateinstances [eg - src_user != 'someUserNameExperiencingFalsePositives'].

[ec2_modification_api_calls]
definition = (eventName=AssociateAddress OR eventName=AssociateIamInstanceProfile OR eventName=AttachClassicLinkVpc OR eventName=AttachNetworkInterface OR eventName=AttachVolume OR eventName=BundleInstance OR eventName=DetachClassicLinkVpc OR eventName=DetachVolume OR eventName=GetConsoleOutput OR eventName=GetConsoleScreenshot OR eventName=ModifyInstanceAttribute OR eventName=ModifyInstancePlacement OR eventName=MonitorInstances OR eventName=RebootInstances OR eventName=ResetInstanceAttribute OR eventName=StartInstances OR eventName=StopInstances OR eventName=TerminateInstances OR eventName=UnmonitorInstances)
description = This is a list of AWS event names that have to do with modifying Amazon EC2 instances

[email_files_not_in_outlook_directory_filter]
definition = search *
description = Use this macro to add additional filters to exclude false positive results

[evilginx_phishlets_0365]
definition = (query=login* AND query=www*)
description = This limits the query fields to domains that are associated with evilginx masquerading as Office 365

[evilginx_phishlets_amazon]
definition = (query=fls-na* AND query = www* AND query=images*)
description = This limits the query fields to domains that are associated with evilginx masquerading as Amazon

[evilginx_phishlets_aws]
definition = (query=www* AND query=aws* AND query=console.aws* AND query=signin.aws* AND api-northeast-1.console.aws* AND query=fls-na* AND query=images-na*)
description = This limits the query fields to domains that are associated with evilginx masquerading as an AWS console

[evilginx_phishlets_facebook]
definition = (query=www* AND query = m* AND query=static*)
description = This limits the query fields to domains that are associated with evilginx masquerading as FaceBook

[evilginx_phishlets_github]
definition = (query=api* AND query = github*)
description = This limits the query fields to domains that are associated with evilginx masquerading as GitHub

[evilginx_phishlets_google]
definition = (query=accounts* AND query=ssl* AND query=www*)
description = This limits the query fields to domains that are associated with evilginx masquerading as Google

[evilginx_phishlets_outlook]
definition = (query=outlook* AND query=login* AND query=account*)
description = This limits the query fields to domains that are associated with evilginx masquerading as Outlook

[file_write_spikes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[filter_rare_process_whitelist]
definition = lookup update=true lookup_rare_process_whitelist_default process as process OUTPUTNEW whitelist | where whitelist="false" | lookup update=true lookup_rare_process_whitelist_local process as process OUTPUT whitelist | where whitelist="false"
description = This macro is intended to whitelist processes that have been definied as rare

[first_time_seen_cmd_line_filter]
definition = search *
description = Use this macro to add additional filters for first time seen command line, you can exclude legitimate parent_processes that spawn cmd.exe. Eg- seach parent_process_name != "foo"

[is_windows_system_file]
definition = lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true
description = This macro limits the output to process names that are in the Windows System directory

[kubernetes_aws_scan_fingerprint_detection]
definition = search *
description = Use this macro to add additional filters

[kubernetes_gcp_scan_fingerprint_detection]
definition = search *
description = Use this macro to add additional filters

[kubernetes_pods_aws_scan_fingerprint_detection]
definition = search *
description = Use this macro to add additional filters

[lnk_executing_a_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[malicious_powershell_process_obfuscation_techniques_output_filter]
definition = search *
description = Use this macro to add output filters for Malicious PowerShell Process With Obfuscation Techniques.

[network_acl_events]
definition = (eventName = CreateNetworkAcl OR eventName = CreateNetworkAclEntry OR eventName = DeleteNetworkAcl OR eventName = DeleteNetworkAclEntry OR eventName = ReplaceNetworkAclEntry OR eventName = ReplaceNetworkAclAssociation)
description = This is a list of AWS event names that are associated with Network ACLs

[okta_failed_sso_attempt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[okta_multiple_users_with_auth_failures_from_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[okta_user_lockouts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[okta_user_logins_from_multiple_cities_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[outbound_smb_connections_filter]
definition = search *
description = Use this macro to add additional filters for outbound SMB traffic detection

[outlook_writing_zip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[previously_seen_cloud_compute_creations_by_user_input_filter]
definition = search *
description = Use this macro to add additional filters for monitoring users that create cloud compute images

[previously_seen_cloud_compute_creations_by_user_search_window_begin_offset]
definition = -70m@m
description = Use this macro to determine how far into the past the window should be to determine if the user is new or not

[previously_seen_cloud_compute_image_input_filter]
definition = search *
description = Use this macro to add additional filters for monitoring cloud compute images

[previously_seen_cloud_compute_image_search_window_begin_offset]
definition = -70m@m
description = Use this macro to determine how far into the past the window should be to determine if the image is new or not

[previously_seen_cloud_compute_instance_types_input_filter]
definition = search *
description = Use this macro to add additional filters for monitoring cloud compute instance types

[previously_seen_cloud_compute_instance_types_search_window_begin_offset]
definition = -70m@m
description = Use this macro to determine how far into the past the window should be to determine if the instance type is new or not

[previously_seen_cloud_regions_input_filter]
definition = search *
description = Use this macro to add additional filters for monitoring your cloud regions

[previously_seen_cloud_regions_search_window_begin_offset]
definition = -70m@m
description = Use this macro to determine how far into the past the window should be to determine if the region is new or not

[prohibited_apps_launching_cmd]
definition = | inputlookup prohibited_apps_launching_cmd | rename prohibited_applications as parent_process_name | eval parent_process_name="*" . parent_process_name | table parent_process_name
description = This macro outputs a list of process that should not be the parent process of cmd.exe

[prohibited_softwares]
definition = lookup interesting_processes_lookup app as process_name OUTPUT is_prohibited | search is_prohibited=True
description = This macro limits the output to process_names that have been marked as prohibited

[ransomware_extensions]
definition = lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Name | search Name !=False
description = This macro limits the output to files that have extensions associated with ransomware

[ransomware_notes]
definition = lookup ransomware_notes_lookup ransomware_notes as file_name OUTPUT status as "Known Ransomware Notes" | search "Known Ransomware Notes"=True
description = This macro limits the output to files that have been identified as a ransomware note

[rare_executables_on_endpoint_filter]
definition = search *
description = Update this macro to filter out false positives

[remote_desktop_network_traffic_filter]
definition = search *
description = Use this macro to add additional filters for remote desktop network traffic

[remote_desktop_process_running_on_system_filter]
definition = search *
description = Use this macro to add additional filters for remote desktop process running on system

[remove_valid_domains]
definition = eval domain=trim(domain,"*") | search NOT[| inputlookup domains]  NOT[ |inputlookup cim_corporate_email_domain_lookup] NOT[inputlookup cim_corporate_web_domain_lookup] | eval domain="*"+domain+"*"
description = This macro removes valid domains from the output

[schtasks_scheduling_job_on_remote_system_filter]
definition = search *
description = Use this macro to add additional filters for schtasks scheduling job on remote system

[security_content_ctime(1)]
args = field
definition = convert timeformat="%m/%d/%Y %H:%M:%S" ctime($field$)
description = convert epoch time to string

[security_content_summariesonly]
definition = summariesonly=true allow_old_summaries=true
description = search data model's summaries only

[security_group_api_calls]
definition = (eventName=AuthorizeSecurityGroupIngress OR eventName=CreateSecurityGroup OR eventName=DeleteSecurityGroup OR eventName=DescribeClusterSecurityGroups OR eventName=DescribeDBSecurityGroups OR eventName=DescribeSecurityGroupReferences OR eventName=DescribeSecurityGroups OR eventName=DescribeStaleSecurityGroups OR eventName=RevokeSecurityGroupIngress OR eventName=UpdateSecurityGroupRuleDescriptionsIngress)
description = This macro is a list of AWS event names associated with security groups

[smb_traffic_spike_filter]
definition = search *
description = Use this macro to add additional filters for SMB traffic spike detection

[smb_traffic_spike_mltk_filter]
definition = search *
description = Use this macro to add additional filters for SMB traffic spike detection using MLKT

[suspicious_email_attachments]
definition = lookup update=true is_suspicious_file_extension_lookup file_name OUTPUT suspicious | search suspicious=true
description = This macro limits the output to email attachments that have suspicious extensions

[suspicious_email_attachments_filter]
definition = search *
description = Use this macro to add additional filters for suspicious email attachments

[suspicious_reg_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[suspicious_writes]
definition = lookup suspicious_writes_lookup file as file_name OUTPUT note as "Reference" | search "Reference" != False
description = This macro limites the output to file names that have been marked as suspicious

[sysmon]
definition = sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
description = customer specific splunk configurations(eg- index, source, sourcetype) for Windows Sysmon Logs. Replace the macro definition with configurations for your Splunk Environmnent.

[system_network_configuration_discovery_tools]
definition = (process_name= "arp.exe" OR process_name= "at.exe" OR process_name= "attrib.exe" OR process_name= "cscript.exe" OR process_name= "dsquery.exe" OR process_name= "hostname.exe" OR process_name= "ipconfig.exe" OR process_name= "mimikatz.exe" OR process_name= "nbstat.exe" OR process_name= "net.exe" OR process_name= "netsh.exe" OR process_name= "nslookup.exe" OR process_name= "ping.exe" OR process_name= "quser.exe" OR process_name= "qwinsta.exe" OR process_name= "reg.exe" OR process_name= "runas.exe" OR process_name= "sc.exe" OR process_name= "schtasks.exe" OR process_name= "ssh.exe" OR process_name= "systeminfo.exe" OR process_name= "taskkill.exe" OR process_name= "telnet.exe" OR process_name= "tracert.exe" OR process_name="wscript.exe" OR process_name= "xcopy.exe")
description = This macro is a list of process that can be used to discover the network configuration

[unauthorized_dns_servers_filter]
definition = search *
description = Use this macro to add additional filters for DNS Query Requests Resolved by Unauthorized DNS Servers detection

[uncommon_processes]
definition = lookup update=true lookup_uncommon_processes_default process_name as process_name outputnew uncommon_default,category_default,analytic_story_default,kill_chain_phase_default,mitre_attack_default | lookup update=true  lookup_uncommon_processes_local process_name as process_name outputnew uncommon_local,category_local,analytic_story_local,kill_chain_phase_local,mitre_attack_local | eval uncommon = coalesce(uncommon_default, uncommon_local), analytic_story = coalesce(analytic_story_default, analytic_story_local), category=coalesce(category_default, category_local), kill_chain_phase=coalesce(kill_chain_phase_default, kill_chain_phase_local), mitre_attack=coalesce(mitre_attack_default, mitre_attack_local) | fields - analytic_story_default, analytic_story_local, category_default, category_local, kill_chain_phase_default, kill_chain_phase_local, mitre_attack_default, mitre_attack_local, uncommon_default, uncommon_local | search uncommon=true
description = This macro limits the output to processes that have been marked as uncommon

[uncommon_processes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[unload_sysmon_filter_driver_filter]
definition = search *
description = Use this macro to add additional filter for Unload sysmon filter driver search to filter out the false positives

[unsigned_image_loaded_by_LSASS_filter]
definition = search *
description = Use this macro to add additional filter for unsigned image loaded by LSASS

[unusually_long_commandlines_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[wineventlog_security]
definition = eventtype="wineventlog_security"
description = Customer specific splunk configurations(eg- index, source, sourcetype) for Windows Event Logs. Replace the macro definition with configurations for your Splunk Environmnent.

[wmi_process_launch_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.

[wmi_script_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.