splunk-security_content/macros/system_network_configuration_discovery_tools.yml

definition: (process_name= "arp.exe" OR process_name= "at.exe" OR process_name= "attrib.exe"
  OR process_name= "cscript.exe" OR process_name= "dsquery.exe" OR process_name= "hostname.exe"
  OR process_name= "ipconfig.exe" OR process_name= "mimikatz.exe" OR process_name=
  "nbstat.exe" OR process_name= "net.exe" OR process_name= "netsh.exe" OR process_name=
  "nslookup.exe" OR process_name= "ping.exe" OR process_name= "quser.exe" OR process_name=
  "qwinsta.exe" OR process_name= "reg.exe" OR process_name= "runas.exe" OR process_name=
  "sc.exe" OR process_name= "schtasks.exe" OR process_name= "ssh.exe" OR process_name=
  "systeminfo.exe" OR process_name= "taskkill.exe" OR process_name= "telnet.exe" OR
  process_name= "tracert.exe" OR process_name="wscript.exe" OR process_name= "xcopy.exe")
description: This macro is a list of process that can be used to discover the network
  configuration
name: system_network_configuration_discovery_tools