mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
David Dorsey
3d25c40bf7
Broke out macros definition into it's own manifest Created macro manifests for all of current macros that we ship Created lookup file manifest Created lookup file manifests for all current lookup files that we ship
564 lines
11 KiB
CSV
564 lines
11 KiB
CSV
filename,systemFile
|
|
arp.exe,true
|
|
adaptertroubleshooter.exe,true
|
|
applicationframehost.exe,true
|
|
atbroker.exe,true
|
|
authhost.exe,true
|
|
autoworkplace.exe,true
|
|
axinstui.exe,true
|
|
backgroundtransferhost.exe,true
|
|
bdehdcfg.exe,true
|
|
bdeuisrv.exe,true
|
|
bdeunlockwizard.exe,true
|
|
bitlockerdeviceencryption.exe,true
|
|
bitlockerwizard.exe,true
|
|
bitlockerwizardelev.exe,true
|
|
bytecodegenerator.exe,true
|
|
camerasettingsuihost.exe,true
|
|
castsrv.exe,true
|
|
certenrollctrl.exe,true
|
|
checknetisolation.exe,true
|
|
clipup.exe,true
|
|
cloudexperiencehostbroker.exe,true
|
|
cloudnotifications.exe,true
|
|
cloudstoragewizard.exe,true
|
|
compmgmtlauncher.exe,true
|
|
compattelrunner.exe,true
|
|
computerdefaults.exe,true
|
|
credentialuibroker.exe,true
|
|
dfdwiz.exe,true
|
|
dwwin.exe,true
|
|
dataexchangehost.exe,true
|
|
defrag.exe,true
|
|
devicedisplayobjectprovider.exe,true
|
|
deviceeject.exe,true
|
|
deviceenroller.exe,true
|
|
devicepairingwizard.exe,true
|
|
deviceproperties.exe,true
|
|
disksnapshot.exe,true
|
|
dism.exe,true
|
|
displayswitch.exe,true
|
|
dmnotificationbroker.exe,true
|
|
dmomacpmo.exe,true
|
|
dpiscaling.exe,true
|
|
dsmusertask.exe,true
|
|
dxpserver.exe,true
|
|
edpcleanup.exe,true
|
|
eosnotify.exe,true
|
|
eap3host.exe,true
|
|
easpoliciesbrokerhost.exe,true
|
|
easeofaccessdialog.exe,true
|
|
ehstorauthn.exe,true
|
|
fxscover.exe,true
|
|
fxssvc.exe,true
|
|
fxsunatd.exe,true
|
|
filehistory.exe,true
|
|
fondue.exe,true
|
|
gamepanel.exe,true
|
|
genvalobj.exe,true
|
|
gettingstarted.exe,true
|
|
hostname.exe,true
|
|
icsentitlementhost.exe,true
|
|
infdefaultinstall.exe,true
|
|
installagent.exe,true
|
|
languagecomponentsinstallercomhandler.exe,true
|
|
launchtm.exe,true
|
|
launchwinapp.exe,true
|
|
legacynetuxhost.exe,true
|
|
licensemanagershellext.exe,true
|
|
licensingui.exe,true
|
|
locationnotificationwindows.exe,true
|
|
locationnotifications.exe,true
|
|
locator.exe,true
|
|
lockapphost.exe,true
|
|
lockscreencontentserver.exe,true
|
|
logonui.exe,true
|
|
lsaiso.exe,true
|
|
mdeserver.exe,true
|
|
mdmagent.exe,true
|
|
mdmappinstaller.exe,true
|
|
mrinfo.exe,true
|
|
mrt.exe,true
|
|
mschedexe.exe,true
|
|
magnify.exe,true
|
|
mbaeparsertask.exe,true
|
|
mdres.exe,true
|
|
mdsched.exe,true
|
|
migautoplay.exe,true
|
|
mpsigstub.exe,true
|
|
msspellcheckinghost.exe,true
|
|
muiunattend.exe,true
|
|
multidigimon.exe,true
|
|
musnotification.exe,true
|
|
musnotificationux.exe,true
|
|
napstat.exe,true
|
|
netstat.exe,true
|
|
narrator.exe,true
|
|
netcfgnotifyobjecthost.exe,true
|
|
netevtfwdr.exe,true
|
|
netproj.exe,true
|
|
netplwiz.exe,true
|
|
networkuxbroker.exe,true
|
|
openwith.exe,true
|
|
optionalfeatures.exe,true
|
|
pathping.exe,true
|
|
ping.exe,true
|
|
passwordonwakesettingflyout.exe,true
|
|
pickerhost.exe,true
|
|
pkgmgr.exe,true
|
|
pnpunattend.exe,true
|
|
pnputil.exe,true
|
|
presentationhost.exe,true
|
|
presentationsettings.exe,true
|
|
printbrmui.exe,true
|
|
printdialoghost.exe,true
|
|
printdialoghost3d.exe,true
|
|
printisolationhost.exe,true
|
|
proximityuxhost.exe,true
|
|
rdspnf.exe,true
|
|
rmactivate.exe,true
|
|
rmactivate_isv.exe,true
|
|
rmactivate_ssp.exe,true
|
|
rmactivate_ssp_isv.exe,true
|
|
route.exe,true
|
|
rdpsa.exe,true
|
|
rdpsaproxy.exe,true
|
|
rdpsauachelper.exe,true
|
|
reagentc.exe,true
|
|
recoverydrive.exe,true
|
|
register-cimprovider.exe,true
|
|
registeriepkeys.exe,true
|
|
relpost.exe,true
|
|
remoteposworker.exe,true
|
|
rmclient.exe,true
|
|
robocopy.exe,true
|
|
rpcping.exe,true
|
|
runlegacycplelevated.exe,true
|
|
runtimebroker.exe,true
|
|
sihclient.exe,true
|
|
searchfilterhost.exe,true
|
|
searchindexer.exe,true
|
|
searchprotocolhost.exe,true
|
|
secedit.exe,true
|
|
sensordataservice.exe,true
|
|
setieinstalleddate.exe,true
|
|
settingsynchost.exe,true
|
|
slidetoshutdown.exe,true
|
|
smartscreensettings.exe,true
|
|
sndvol.exe,true
|
|
snippingtool.exe,true
|
|
soundrecorder.exe,true
|
|
spaceagent.exe,true
|
|
sppextcomobj.exe,true
|
|
srtasks.exe,true
|
|
stikynot.exe,true
|
|
synchost.exe,true
|
|
sysreseterr.exe,true
|
|
systempropertiesadvanced.exe,true
|
|
systempropertiescomputername.exe,true
|
|
systempropertiesdataexecutionprevention.exe,true
|
|
systempropertieshardware.exe,true
|
|
systempropertiesperformance.exe,true
|
|
systempropertiesprotection.exe,true
|
|
systempropertiesremote.exe,true
|
|
systemsettingsadminflows.exe,true
|
|
systemsettingsbroker.exe,true
|
|
systemsettingsremovedevice.exe,true
|
|
tcpsvcs.exe,true
|
|
tracert.exe,true
|
|
tstheme.exe,true
|
|
tswbprxy.exe,true
|
|
tapiunattend.exe,true
|
|
taskmgr.exe,true
|
|
thumbnailextractionhost.exe,true
|
|
tokenbrokercookies.exe,true
|
|
tpminit.exe,true
|
|
tswpfwrp.exe,true
|
|
ui0detect.exe,true
|
|
upgraderesultsui.exe,true
|
|
useraccountbroker.exe,true
|
|
useraccountcontrolsettings.exe,true
|
|
usoclient.exe,true
|
|
utilman.exe,true
|
|
vssvc.exe,true
|
|
vaultcmd.exe,true
|
|
vaultsysui.exe,true
|
|
wfs.exe,true
|
|
wmpdmc.exe,true
|
|
wpdshextautoplay.exe,true
|
|
wscollect.exe,true
|
|
wsmanhttpconfig.exe,true
|
|
wsreset.exe,true
|
|
wudfhost.exe,true
|
|
wwahost.exe,true
|
|
wallpaperhost.exe,true
|
|
webcache.exe,true
|
|
werfault.exe,true
|
|
werfaultsecure.exe,true
|
|
winsat.exe,true
|
|
windows.media.backgroundplayback.exe,true
|
|
windowsactiondialog.exe,true
|
|
windowsanytimeupgrade.exe,true
|
|
windowsanytimeupgraderesults.exe,true
|
|
windowsanytimeupgradeui.exe,true
|
|
windowsupdateelevatedinstaller.exe,true
|
|
workfolders.exe,true
|
|
wpcmon.exe,true
|
|
acu.exe,true
|
|
aitagent.exe,true
|
|
aitstatic.exe,true
|
|
alg.exe,true
|
|
appidcertstorecheck.exe,true
|
|
appidpolicyconverter.exe,true
|
|
at.exe,true
|
|
attrib.exe,true
|
|
audiodg.exe,true
|
|
auditpol.exe,true
|
|
autochk.exe,true
|
|
autoconv.exe,true
|
|
autofmt.exe,true
|
|
baaupdate.exe,true
|
|
backgroundtaskhost.exe,true
|
|
bcastdvr.exe,true
|
|
bcdboot.exe,true
|
|
bcdedit.exe,true
|
|
bdechangepin.exe,true
|
|
bdeunlock.exe,true
|
|
bitsadmin.exe,true
|
|
bootcfg.exe,true
|
|
bootim.exe,true
|
|
bootsect.exe,true
|
|
bridgeunattend.exe,true
|
|
browser_broker.exe,true
|
|
bthudtask.exe,true
|
|
cacls.exe,true
|
|
calc.exe,true
|
|
cdpreference.exe,true
|
|
certreq.exe,true
|
|
certutil.exe,true
|
|
change.exe,true
|
|
changepk.exe,true
|
|
charmap.exe,true
|
|
chglogon.exe,true
|
|
chgport.exe,true
|
|
chgusr.exe,true
|
|
chkdsk.exe,true
|
|
chkntfs.exe,true
|
|
choice.exe,true
|
|
cipher.exe,true
|
|
cleanmgr.exe,true
|
|
cliconfg.exe,true
|
|
clip.exe,true
|
|
cmd.exe,true
|
|
cmdkey.exe,true
|
|
cmdl32.exe,true
|
|
cmmon32.exe,true
|
|
cmstp.exe,true
|
|
cofire.exe,true
|
|
colorcpl.exe,true
|
|
comp.exe,true
|
|
compact.exe,true
|
|
conhost.exe,true
|
|
consent.exe,true
|
|
control.exe,true
|
|
convert.exe,true
|
|
credwiz.exe,true
|
|
cscript.exe,true
|
|
csrss.exe,true
|
|
ctfmon.exe,true
|
|
cttune.exe,true
|
|
cttunesvr.exe,true
|
|
dashost.exe,true
|
|
dccw.exe,true
|
|
dcomcnfg.exe,true
|
|
ddodiag.exe,true
|
|
dfrgui.exe,true
|
|
dialer.exe,true
|
|
diantz.exe,true
|
|
dinotify.exe,true
|
|
diskpart.exe,true
|
|
diskperf.exe,true
|
|
diskraid.exe,true
|
|
dispdiag.exe,true
|
|
djoin.exe,true
|
|
dllhost.exe,true
|
|
dllhst3g.exe,true
|
|
dmcertinst.exe,true
|
|
dmcfghost.exe,true
|
|
dmclient.exe,true
|
|
dnscacheugc.exe,true
|
|
doskey.exe,true
|
|
dpapimig.exe,true
|
|
dpnsvr.exe,true
|
|
driverquery.exe,true
|
|
drvcfg.exe,true
|
|
drvinst.exe,true
|
|
dsregcmd.exe,true
|
|
dstokenclean.exe,true
|
|
dvdplay.exe,true
|
|
dvdupgrd.exe,true
|
|
dwm.exe,true
|
|
dxdiag.exe,true
|
|
easinvoker.exe,true
|
|
efsui.exe,true
|
|
embeddedapplauncher.exe,true
|
|
esentutl.exe,true
|
|
eudcedit.exe,true
|
|
eventcreate.exe,true
|
|
eventvwr.exe,true
|
|
expand.exe,true
|
|
extrac32.exe,true
|
|
fc.exe,true
|
|
fhmanagew.exe,true
|
|
find.exe,true
|
|
findstr.exe,true
|
|
finger.exe,true
|
|
fixmapi.exe,true
|
|
fltmc.exe,true
|
|
fodhelper.exe,true
|
|
fontdrvhost.exe,true
|
|
fontview.exe,true
|
|
forfiles.exe,true
|
|
fsavailux.exe,true
|
|
fsquirt.exe,true
|
|
fsutil.exe,true
|
|
ftp.exe,true
|
|
fvenotify.exe,true
|
|
fveprompt.exe,true
|
|
getmac.exe,true
|
|
gpresult.exe,true
|
|
gpscript.exe,true
|
|
gpupdate.exe,true
|
|
grpconv.exe,true
|
|
hdwwiz.exe,true
|
|
help.exe,true
|
|
hwrcomp.exe,true
|
|
hwrreg.exe,true
|
|
icacls.exe,true
|
|
icardagt.exe,true
|
|
icsunattend.exe,true
|
|
ie4uinit.exe,true
|
|
ieunatt.exe,true
|
|
ieetwcollector.exe,true
|
|
iexpress.exe,true
|
|
immersivetpmvscmgrsvr.exe,true
|
|
ipconfig.exe,true
|
|
irftp.exe,true
|
|
iscsicli.exe,true
|
|
iscsicpl.exe,true
|
|
isoburn.exe,true
|
|
klist.exe,true
|
|
ksetup.exe,true
|
|
ktmutil.exe,true
|
|
label.exe,true
|
|
licensingdiag.exe,true
|
|
lodctr.exe,true
|
|
logagent.exe,true
|
|
logman.exe,true
|
|
logoff.exe,true
|
|
lpkinstall.exe,true
|
|
lpksetup.exe,true
|
|
lpremove.exe,true
|
|
lsass.exe,true
|
|
lsm.exe,true
|
|
makecab.exe,true
|
|
manage-bde.exe,true
|
|
mblctr.exe,true
|
|
mcbuilder.exe,true
|
|
mctadmin.exe,true
|
|
mfpmp.exe,true
|
|
mmc.exe,true
|
|
mobsync.exe,true
|
|
mountvol.exe,true
|
|
mpnotify.exe,true
|
|
msconfig.exe,true
|
|
msdt.exe,true
|
|
msdtc.exe,true
|
|
msfeedssync.exe,true
|
|
msg.exe,true
|
|
mshta.exe,true
|
|
msiexec.exe,true
|
|
msinfo32.exe,true
|
|
mspaint.exe,true
|
|
msra.exe,true
|
|
mstsc.exe,true
|
|
mtstocom.exe,true
|
|
nbtstat.exe,true
|
|
ndadmin.exe,true
|
|
net.exe,true
|
|
net1.exe,true
|
|
netbtugc.exe,true
|
|
netcfg.exe,true
|
|
netiougc.exe,true
|
|
netsh.exe,true
|
|
newdev.exe,true
|
|
nltest.exe,true
|
|
notepad.exe,true
|
|
nslookup.exe,true
|
|
ntoskrnl.exe,true
|
|
ntprint.exe,true
|
|
ocsetup.exe,true
|
|
odbcad32.exe,true
|
|
odbcconf.exe,true
|
|
omadmclient.exe,true
|
|
omadmprc.exe,true
|
|
openfiles.exe,true
|
|
osk.exe,true
|
|
p2phost.exe,true
|
|
pcalua.exe,true
|
|
pcaui.exe,true
|
|
pcawrk.exe,true
|
|
pcwrun.exe,true
|
|
perfmon.exe,true
|
|
phoneactivate.exe,true
|
|
plasrv.exe,true
|
|
poqexec.exe,true
|
|
powercfg.exe,true
|
|
prevhost.exe,true
|
|
print.exe,true
|
|
printfilterpipelinesvc.exe,true
|
|
printui.exe,true
|
|
proquota.exe,true
|
|
provtool.exe,true
|
|
psr.exe,true
|
|
pwlauncher.exe,true
|
|
qappsrv.exe,true
|
|
qprocess.exe,true
|
|
query.exe,true
|
|
quser.exe,true
|
|
qwinsta.exe,true
|
|
rasautou.exe,true
|
|
rasdial.exe,true
|
|
raserver.exe,true
|
|
rasphone.exe,true
|
|
rdpclip.exe,true
|
|
rdpinput.exe,true
|
|
rdrleakdiag.exe,true
|
|
recdisc.exe,true
|
|
recover.exe,true
|
|
reg.exe,true
|
|
regedt32.exe,true
|
|
regini.exe,true
|
|
regsvr32.exe,true
|
|
rekeywiz.exe,true
|
|
relog.exe,true
|
|
repair-bde.exe,true
|
|
replace.exe,true
|
|
reset.exe,true
|
|
resmon.exe,true
|
|
rmttpmvscmgrsvr.exe,true
|
|
rrinstaller.exe,true
|
|
rstrui.exe,true
|
|
runas.exe,true
|
|
rundll32.exe,true
|
|
runonce.exe,true
|
|
rwinsta.exe,true
|
|
sbunattend.exe,true
|
|
sc.exe,true
|
|
schtasks.exe,true
|
|
sdbinst.exe,true
|
|
sdchange.exe,true
|
|
sdclt.exe,true
|
|
sdiagnhost.exe,true
|
|
secinit.exe,true
|
|
services.exe,true
|
|
sessionmsg.exe,true
|
|
sethc.exe,true
|
|
setspn.exe,true
|
|
setupcl.exe,true
|
|
setupugc.exe,true
|
|
setx.exe,true
|
|
sfc.exe,true
|
|
shadow.exe,true
|
|
shrpubw.exe,true
|
|
shutdown.exe,true
|
|
sigverif.exe,true
|
|
sihost.exe,true
|
|
slui.exe,true
|
|
smss.exe,true
|
|
snmptrap.exe,true
|
|
sort.exe,true
|
|
spinstall.exe,true
|
|
spoolsv.exe,true
|
|
sppsvc.exe,true
|
|
spreview.exe,true
|
|
srdelayed.exe,true
|
|
subst.exe,true
|
|
svchost.exe,true
|
|
sxstrace.exe,true
|
|
syskey.exe,true
|
|
systeminfo.exe,true
|
|
systemreset.exe,true
|
|
systray.exe,true
|
|
tabcal.exe,true
|
|
takeown.exe,true
|
|
taskeng.exe,true
|
|
taskhost.exe,true
|
|
taskhostw.exe,true
|
|
taskkill.exe,true
|
|
tasklist.exe,true
|
|
taskmgr.exe,true
|
|
tcmsetup.exe,true
|
|
timeout.exe,true
|
|
tpmvscmgr.exe,true
|
|
tpmvscmgrsvr.exe,true
|
|
tracerpt.exe,true
|
|
tscon.exe,true
|
|
tsdiscon.exe,true
|
|
tskill.exe,true
|
|
typeperf.exe,true
|
|
tzsync.exe,true
|
|
tzutil.exe,true
|
|
ucsvc.exe,true
|
|
unlodctr.exe,true
|
|
unregmp2.exe,true
|
|
upnpcont.exe,true
|
|
userinit.exe,true
|
|
vds.exe,true
|
|
vdsldr.exe,true
|
|
verclsid.exe,true
|
|
verifier.exe,true
|
|
verifiergui.exe,true
|
|
vmicsvc.exe,true
|
|
vssadmin.exe,true
|
|
w32tm.exe,true
|
|
waitfor.exe,true
|
|
wbadmin.exe,true
|
|
wbengine.exe,true
|
|
wecutil.exe,true
|
|
wermgr.exe,true
|
|
wevtutil.exe,true
|
|
wextract.exe,true
|
|
where.exe,true
|
|
whoami.exe,true
|
|
wiaacmgr.exe,true
|
|
wiawow64.exe,true
|
|
wifitask.exe,true
|
|
wimserv.exe,true
|
|
wininit.exe,true
|
|
winload.exe,true
|
|
winlogon.exe,true
|
|
winresume.exe,true
|
|
winrs.exe,true
|
|
winrshost.exe,true
|
|
winver.exe,true
|
|
wisptis.exe,true
|
|
wkspbroker.exe,true
|
|
wksprt.exe,true
|
|
wlanext.exe,true
|
|
wlrmdr.exe,true
|
|
wowreg32.exe,true
|
|
wpnpinst.exe,true
|
|
wpr.exe,true
|
|
write.exe,true
|
|
wscript.exe,true
|
|
wsmprovhost.exe,true
|
|
wsqmcons.exe,true
|
|
wuapihost.exe,true
|
|
wuapp.exe,true
|
|
wuauclt.exe,true
|
|
wusa.exe,true
|
|
xcopy.exe,true
|
|
xpsrchvw.exe,true
|
|
xwizard.exe,true
|