mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
P4T12ICK
680 lines
45 KiB
JSON
680 lines
45 KiB
JSON
[
|
|
{
|
|
"name": "aws_cloudwatchlogs_eks",
|
|
"definition": "sourcetype=\"aws:cloudwatchlogs:eks\"",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "aws_config",
|
|
"definition": "sourcetype=aws:config",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "aws_description",
|
|
"definition": "sourcetype=\"aws:description\"",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "aws_ecr_users",
|
|
"definition": "userName IN (user)",
|
|
"description": "specify the user allowed to push Images to AWS ECR."
|
|
},
|
|
{
|
|
"name": "aws_s3_accesslogs",
|
|
"definition": "sourcetype=aws:s3:accesslogs",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "aws_securityhub_finding",
|
|
"definition": "sourcetype=\"aws:securityhub:finding\"",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "aws_securityhub_firehose",
|
|
"definition": "sourcetype=\"aws:securityhub:firehose\"",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "brand_abuse_dns",
|
|
"definition": "lookup update=true brandMonitoring_lookup domain as query OUTPUT domain_abuse | search domain_abuse=true",
|
|
"description": "This macro limits the output to only domains that are in the brand monitoring lookup file"
|
|
},
|
|
{
|
|
"name": "brand_abuse_email",
|
|
"definition": "lookup update=true brandMonitoring_lookup domain as src_user OUTPUT domain_abuse | search domain_abuse=true",
|
|
"description": "This macro limits the output to only domains that are in the brand monitoring lookup file"
|
|
},
|
|
{
|
|
"name": "brand_abuse_web",
|
|
"definition": "lookup update=true brandMonitoring_lookup domain as urls OUTPUT domain_abuse | search domain_abuse=true",
|
|
"description": "This macro limits the output to only domains that are in the brand monitoring lookup file"
|
|
},
|
|
{
|
|
"name": "circleci",
|
|
"definition": "sourcetype=circleci",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "cisco_networks",
|
|
"definition": "eventtype=cisco_ios",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "cloud_api_calls_from_previously_unseen_user_roles_activity_window",
|
|
"definition": "\"-70m@m\"",
|
|
"description": "Use this macro to determine how far back you should be checking for new commands from user roles"
|
|
},
|
|
{
|
|
"name": "cloudtrail",
|
|
"definition": "sourcetype=aws:cloudtrail",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "cloudwatch_eks",
|
|
"definition": "sourcetype=\"aws:cloudwatchlogs:eks\"",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch eks logs. Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "cloudwatch_vpc",
|
|
"definition": "sourcetype=aws:cloudwatchlogs:vpcflow",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch vpc logs. Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "cloudwatchlogs_vpcflow",
|
|
"definition": "sourcetype=aws:cloudwatchlogs:vpcflow",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "dynamic_dns_providers",
|
|
"definition": "lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True",
|
|
"description": "This macro limits the output of the query field to dynamic dns domains. It looks up the domains in a file provided by Splunk and one intended to be updated by the end user."
|
|
},
|
|
{
|
|
"name": "dynamic_dns_web_traffic",
|
|
"definition": "lookup update=true dynamic_dns_providers_default dynamic_dns_domains as url OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as url OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True",
|
|
"description": "This is a description"
|
|
},
|
|
{
|
|
"name": "ec2_modification_api_calls",
|
|
"definition": "(eventName=AssociateAddress OR eventName=AssociateIamInstanceProfile OR eventName=AttachClassicLinkVpc OR eventName=AttachNetworkInterface OR eventName=AttachVolume OR eventName=BundleInstance OR eventName=DetachClassicLinkVpc OR eventName=DetachVolume OR eventName=ModifyInstanceAttribute OR eventName=ModifyInstancePlacement OR eventName=MonitorInstances OR eventName=RebootInstances OR eventName=ResetInstanceAttribute OR eventName=StartInstances OR eventName=StopInstances OR eventName=TerminateInstances OR eventName=UnmonitorInstances)",
|
|
"description": "This is a list of AWS event names that have to do with modifying Amazon EC2 instances"
|
|
},
|
|
{
|
|
"name": "evilginx_phishlets_0365",
|
|
"definition": "(query=login* AND query=www*)",
|
|
"description": "This limits the query fields to domains that are associated with evilginx masquerading as Office 365"
|
|
},
|
|
{
|
|
"name": "evilginx_phishlets_amazon",
|
|
"definition": "(query=fls-na* AND query = www* AND query=images*)",
|
|
"description": "This limits the query fields to domains that are associated with evilginx masquerading as Amazon"
|
|
},
|
|
{
|
|
"name": "evilginx_phishlets_aws",
|
|
"definition": "(query=www* AND query=aws* AND query=console.aws* AND query=signin.aws* AND api-northeast-1.console.aws* AND query=fls-na* AND query=images-na*)",
|
|
"description": "This limits the query fields to domains that are associated with evilginx masquerading as an AWS console"
|
|
},
|
|
{
|
|
"name": "evilginx_phishlets_facebook",
|
|
"definition": "(query=www* AND query = m* AND query=static*)",
|
|
"description": "This limits the query fields to domains that are associated with evilginx masquerading as FaceBook"
|
|
},
|
|
{
|
|
"name": "evilginx_phishlets_github",
|
|
"definition": "(query=api* AND query = github*)",
|
|
"description": "This limits the query fields to domains that are associated with evilginx masquerading as GitHub"
|
|
},
|
|
{
|
|
"name": "evilginx_phishlets_google",
|
|
"definition": "(query=accounts* AND query=ssl* AND query=www*)",
|
|
"description": "This limits the query fields to domains that are associated with evilginx masquerading as Google"
|
|
},
|
|
{
|
|
"name": "evilginx_phishlets_outlook",
|
|
"definition": "(query=outlook* AND query=login* AND query=account*)",
|
|
"description": "This limits the query fields to domains that are associated with evilginx masquerading as Outlook"
|
|
},
|
|
{
|
|
"name": "exchange",
|
|
"definition": "sourcetype=\"MSWindows:IIS\"",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "f5_bigip_rogue",
|
|
"definition": "index=netops sourcetype=\"f5:bigip:rogue\"",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "filter_rare_process_allow_list",
|
|
"definition": "lookup update=true lookup_rare_process_allow_list_default process as process OUTPUTNEW allow_list | where allow_list=\"false\" | lookup update=true lookup_rare_process_allow_list_local process as process OUTPUT allow_list | where allow_list=\"false\"",
|
|
"description": "This macro is intended to allow_list processes that have been definied as rare"
|
|
},
|
|
{
|
|
"name": "github",
|
|
"definition": "sourcetype=aws:firehose:json",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "github_known_users",
|
|
"definition": "user IN (user_names_here)",
|
|
"description": "specify the user allowed to create PRs in Github projects."
|
|
},
|
|
{
|
|
"name": "google_gcp_pubnet_message",
|
|
"definition": "sourcetype=\"google:gcp:pubsub:message\"",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype) for Google GCP. Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "google_gcp_pubsub_message",
|
|
"definition": "sourcetype=\"google:gcp:pubsub:message\"",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "gsuite_calendar",
|
|
"definition": "sourcetype=gsuite:calendar:json",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "gsuite_drive",
|
|
"definition": "sourcetype=gsuite:drive:json",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "gsuite_gmail",
|
|
"definition": "sourcetype=gsuite:gmail:bigquery",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "is_net_windows_file",
|
|
"definition": "lookup update=true is_net_windows_file filename as process_name OUTPUT netFile | lookup update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile | search netFile=true",
|
|
"description": "This macro limits the output to process names that are .net binaries on Windows Server 2016 and Windows 11."
|
|
},
|
|
{
|
|
"name": "is_nirsoft_software",
|
|
"definition": "lookup update=true is_nirsoft_software filename as process_name OUTPUT nirsoftFile | search nirsoftFile=true",
|
|
"description": "This macro is related to potentially identifiable software related to NirSoft. Remove or filter as needed based."
|
|
},
|
|
{
|
|
"name": "is_windows_system_file",
|
|
"definition": "lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true",
|
|
"description": "This macro limits the output to process names that are in the Windows System directory"
|
|
},
|
|
{
|
|
"name": "kube_objects_events",
|
|
"definition": "sourcetype=kube:objects:events",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "kubernetes_azure",
|
|
"definition": "sourcetype=mscs:storage:blob:json",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data from Azure. Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "kubernetes_container_controller",
|
|
"definition": "sourcetype=kube:container:controller",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data. Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "linux_hosts",
|
|
"definition": "index=*",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "linux_shells",
|
|
"definition": "(Processes.process_name IN (\"sh\", \"ksh\", \"zsh\", \"bash\", \"dash\", \"rbash\", \"fish\", \"csh', \"tcsh', \"ion\", \"eshell\"))",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "netbackup",
|
|
"definition": "sourcetype=\"netbackup_logs\"",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "network_acl_events",
|
|
"definition": "(eventName = CreateNetworkAcl OR eventName = CreateNetworkAclEntry OR eventName = DeleteNetworkAcl OR eventName = DeleteNetworkAclEntry OR eventName = ReplaceNetworkAclEntry OR eventName = ReplaceNetworkAclAssociation)",
|
|
"description": "This is a list of AWS event names that are associated with Network ACLs"
|
|
},
|
|
{
|
|
"name": "notable",
|
|
"definition": "index=notable",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "o365_management_activity",
|
|
"definition": "sourcetype=o365:management:activity",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "okta",
|
|
"definition": "eventtype=okta_log",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "osquery_process",
|
|
"definition": "eventtype=\"osquery-process\"",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "potentially_malicious_code_on_cmdline_tokenize_score",
|
|
"definition": "eval orig_process=process, process=replace(lower(process), \"`\", \"\") | makemv tokenizer=\"([\\w\\d\\-]+)\" process | eval unusual_cmdline_feature_for=if(match(process, \"^for$\"), mvcount(mvfilter(match(process, \"^for$\"))), 0), unusual_cmdline_feature_netsh=if(match(process, \"^netsh$\"), mvcount(mvfilter(match(process, \"^netsh$\"))), 0), unusual_cmdline_feature_readbytes=if(match(process, \"^readbytes$\"), mvcount(mvfilter(match(process, \"^readbytes$\"))), 0), unusual_cmdline_feature_set=if(match(process, \"^set$\"), mvcount(mvfilter(match(process, \"^set$\"))), 0), unusual_cmdline_feature_unrestricted=if(match(process, \"^unrestricted$\"), mvcount(mvfilter(match(process, \"^unrestricted$\"))), 0), unusual_cmdline_feature_winstations=if(match(process, \"^winstations$\"), mvcount(mvfilter(match(process, \"^winstations$\"))), 0), unusual_cmdline_feature_-value=if(match(process, \"^-value$\"), mvcount(mvfilter(match(process, \"^-value$\"))), 0), unusual_cmdline_feature_compression=if(match(process, \"^compression$\"), mvcount(mvfilter(match(process, \"^compression$\"))), 0), unusual_cmdline_feature_server=if(match(process, \"^server$\"), mvcount(mvfilter(match(process, \"^server$\"))), 0), unusual_cmdline_feature_set-mppreference=if(match(process, \"^set-mppreference$\"), mvcount(mvfilter(match(process, \"^set-mppreference$\"))), 0), unusual_cmdline_feature_terminal=if(match(process, \"^terminal$\"), mvcount(mvfilter(match(process, \"^terminal$\"))), 0), unusual_cmdline_feature_-name=if(match(process, \"^-name$\"), mvcount(mvfilter(match(process, \"^-name$\"))), 0), unusual_cmdline_feature_catch=if(match(process, \"^catch$\"), mvcount(mvfilter(match(process, \"^catch$\"))), 0), unusual_cmdline_feature_get-wmiobject=if(match(process, \"^get-wmiobject$\"), mvcount(mvfilter(match(process, \"^get-wmiobject$\"))), 0), unusual_cmdline_feature_hklm=if(match(process, \"^hklm$\"), mvcount(mvfilter(match(process, \"^hklm$\"))), 0), unusual_cmdline_feature_streamreader=if(match(process, \"^streamreader$\"), mvcount(mvfilter(match(process, \"^streamreader$\"))), 0), unusual_cmdline_feature_system32=if(match(process, \"^system32$\"), mvcount(mvfilter(match(process, \"^system32$\"))), 0), unusual_cmdline_feature_username=if(match(process, \"^username$\"), mvcount(mvfilter(match(process, \"^username$\"))), 0), unusual_cmdline_feature_webrequest=if(match(process, \"^webrequest$\"), mvcount(mvfilter(match(process, \"^webrequest$\"))), 0), unusual_cmdline_feature_count=if(match(process, \"^count$\"), mvcount(mvfilter(match(process, \"^count$\"))), 0), unusual_cmdline_feature_webclient=if(match(process, \"^webclient$\"), mvcount(mvfilter(match(process, \"^webclient$\"))), 0), unusual_cmdline_feature_writeallbytes=if(match(process, \"^writeallbytes$\"), mvcount(mvfilter(match(process, \"^writeallbytes$\"))), 0), unusual_cmdline_feature_convert=if(match(process, \"^convert$\"), mvcount(mvfilter(match(process, \"^convert$\"))), 0), unusual_cmdline_feature_create=if(match(process, \"^create$\"), mvcount(mvfilter(match(process, \"^create$\"))), 0), unusual_cmdline_feature_function=if(match(process, \"^function$\"), mvcount(mvfilter(match(process, \"^function$\"))), 0), unusual_cmdline_feature_net=if(match(process, \"^net$\"), mvcount(mvfilter(match(process, \"^net$\"))), 0), unusual_cmdline_feature_com=if(match(process, \"^com$\"), mvcount(mvfilter(match(process, \"^com$\"))), 0), unusual_cmdline_feature_http=if(match(process, \"^http$\"), mvcount(mvfilter(match(process, \"^http$\"))), 0), unusual_cmdline_feature_io=if(match(process, \"^io$\"), mvcount(mvfilter(match(process, \"^io$\"))), 0), unusual_cmdline_feature_system=if(match(process, \"^system$\"), mvcount(mvfilter(match(process, \"^system$\"))), 0), unusual_cmdline_feature_new-object=if(match(process, \"^new-object$\"), mvcount(mvfilter(match(process, \"^new-object$\"))), 0), unusual_cmdline_feature_if=if(match(process, \"^if$\"), mvcount(mvfilter(match(process, \"^if$\"))), 0), unusual_cmdline_feature_threading=if(match(process, \"^threading$\"), mvcount(mvfilter(match(process, \"^threading$\"))), 0), unusual_cmdline_feature_mutex=if(match(process, \"^mutex$\"), mvcount(mvfilter(match(process, \"^mutex$\"))), 0), unusual_cmdline_feature_cryptography=if(match(process, \"^cryptography$\"), mvcount(mvfilter(match(process, \"^cryptography$\"))), 0), unusual_cmdline_feature_computehash=if(match(process, \"^computehash$\"), mvcount(mvfilter(match(process, \"^computehash$\"))), 0)",
|
|
"description": "Performs the tokenization and application of the malicious commandline classifier"
|
|
},
|
|
{
|
|
"name": "powershell",
|
|
"definition": "(source=WinEventLog:Microsoft-Windows-PowerShell/Operational OR source=\"XmlWinEventLog:Microsoft-Windows-PowerShell/Operational\")",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "previously_seen_cloud_api_calls_per_user_role_forget_window",
|
|
"definition": "\"-90d@d\"",
|
|
"description": "Use this macro to determine how long to keep track of cloud api calls per user role"
|
|
},
|
|
{
|
|
"name": "previously_seen_cloud_compute_creations_by_user_search_window_begin_offset",
|
|
"definition": "\"-70m@m\"",
|
|
"description": "Use this macro to determine how far into the past the window should be to determine if the user is new or not"
|
|
},
|
|
{
|
|
"name": "previously_seen_cloud_compute_image_search_window_begin_offset",
|
|
"definition": "\"-70m@m\"",
|
|
"description": "Use this macro to determine how far into the past the window should be to determine if the image is new or not"
|
|
},
|
|
{
|
|
"name": "previously_seen_cloud_compute_images_forget_window",
|
|
"definition": "\"-90d@d\"",
|
|
"description": "Use this macro to determine how long to keep track of cloud instance images"
|
|
},
|
|
{
|
|
"name": "previously_seen_cloud_compute_instance_type_forget_window",
|
|
"definition": "\"-90d@d\"",
|
|
"description": "Use this macro to determine how long to keep track of cloud instance types"
|
|
},
|
|
{
|
|
"name": "previously_seen_cloud_compute_instance_types_search_window_begin_offset",
|
|
"definition": "\"-70m@m\"",
|
|
"description": "Use this macro to determine how far into the past the window should be to determine if the instance type is new or not"
|
|
},
|
|
{
|
|
"name": "previously_seen_cloud_instance_modifications_by_user_search_window_begin_offset",
|
|
"definition": "\"-70m@m\"",
|
|
"description": "Use this macro to determine how far into the past the window should be to determine if the user is new or not"
|
|
},
|
|
{
|
|
"name": "previously_seen_cloud_provisioning_activity_forget_window",
|
|
"definition": "\"-90d@d\"",
|
|
"description": "Use this macro to determine how long to keep track of cloud provisioning locations"
|
|
},
|
|
{
|
|
"name": "previously_seen_cloud_region_forget_window",
|
|
"definition": "\"-90d@d\"",
|
|
"description": "Use this macro to determine how long to keep track of cloud regions"
|
|
},
|
|
{
|
|
"name": "previously_seen_cloud_regions_search_window_begin_offset",
|
|
"definition": "\"-70m@m\"",
|
|
"description": "Use this macro to determine how far into the past the window should be to determine if the region is new or not"
|
|
},
|
|
{
|
|
"name": "previously_seen_windows_services_forget_window",
|
|
"definition": "\"-90d@d\"",
|
|
"description": "Use this macro to determine how long to keep track of Windows services"
|
|
},
|
|
{
|
|
"name": "previously_seen_windows_services_window",
|
|
"definition": "\"-70m@m\"",
|
|
"description": "Use this macro to determine how far back you should be checking for new Windows services"
|
|
},
|
|
{
|
|
"name": "previously_seen_zoom_child_processes_forget_window",
|
|
"definition": "\"-90d@d\"",
|
|
"description": "Use this macro to determine how long to keep track of zoom child processes"
|
|
},
|
|
{
|
|
"name": "previously_seen_zoom_child_processes_window",
|
|
"definition": "\"-70m@m\"",
|
|
"description": "Use this macro to determine how far back you should be checking for new zoom child processes"
|
|
},
|
|
{
|
|
"name": "previously_unseen_cloud_provisioning_activity_window",
|
|
"definition": "\"-70m@m\"",
|
|
"description": "Use this macro to determine how far back you should be checking for new provisioning activities"
|
|
},
|
|
{
|
|
"name": "printservice",
|
|
"definition": "source=\"wineventlog:microsoft-windows-printservice/operational\" OR sourcetype=\"WinEventLog:Microsoft-Windows-PrintService/Admin\"",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "process_bitsadmin",
|
|
"definition": "(Processes.process_name=bitsadmin.exe OR Processes.original_file_name=bitsadmin.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_certutil",
|
|
"definition": "(Processes.process_name=certutil.exe OR Processes.original_file_name=CertUtil.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_cmd",
|
|
"definition": "(Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_copy",
|
|
"definition": "(Processes.process_name=copy.exe OR Processes.original_file_name=copy.exe OR Processes.process_name=xcopy.exe OR Processes.original_file_name=xcopy.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_csc",
|
|
"definition": "(Processes.process_name=csc.exe OR Processes.original_file_name=csc.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_curl",
|
|
"definition": "(Processes.process_name=curl.exe OR Processes.original_file_name=Curl.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_diskshadow",
|
|
"definition": "(Processes.process_name=diskshadow.exe OR Processes.original_file_name=diskshadow.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_dllhost",
|
|
"definition": "(Processes.process_name=dllhost.exe OR Processes.original_file_name=dllhost.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_dsquery",
|
|
"definition": "(Processes.process_name=dsquery.exe OR Processes.original_file_name=dsquery.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_dxdiag",
|
|
"definition": "(Processes.process_name=dxdiag.exe OR Processes.original_file_name=dxdiag.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_esentutl",
|
|
"definition": "(Processes.process_name=esentutl.exe OR Processes.original_file_name=esentutl.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_fodhelper",
|
|
"definition": "(Processes.process_name=fodhelper.exe OR Processes.original_file_name=FodHelper.EXE)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_gpupdate",
|
|
"definition": "(Processes.process_name=gpupdate.exe OR Processes.original_file_name=GPUpdate.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_hh",
|
|
"definition": "(Processes.process_name=hh.exe OR Processes.original_file_name=HH.EXE)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_installutil",
|
|
"definition": "(Processes.process_name=installutil.exe OR Processes.original_file_name=InstallUtil.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_microsoftworkflowcompiler",
|
|
"definition": "(Processes.process_name=microsoft.workflow.compiler.exe OR Processes.original_file_name=Microsoft.Workflow.Compiler.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_msbuild",
|
|
"definition": "(Processes.process_name=msbuild.exe OR Processes.original_file_name=MSBuild.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_mshta",
|
|
"definition": "(Processes.process_name=mshta.exe OR Processes.original_file_name=MSHTA.EXE)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_net",
|
|
"definition": "(Processes.process_name=\"net.exe\" OR Processes.original_file_name=\"net.exe\" OR Processes.process_name=\"net1.exe\" OR Processes.original_file_name=\"net1.exe\")",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_netsh",
|
|
"definition": "(Processes.process_name=netsh.exe OR Processes.original_file_name=netsh.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_nltest",
|
|
"definition": "(Processes.process_name=nltest.exe OR Processes.original_file_name=nltestrk.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_ntdsutil",
|
|
"definition": "(Processes.process_name=ntdsutil.exe OR Processes.original_file_name=ntdsutil.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_ping",
|
|
"definition": "(Processes.process_name=ping.exe OR Processes.original_file_name=ping.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_powershell",
|
|
"definition": "(Processes.process_name=pwsh.exe OR Processes.process_name=sqlps.exe OR Processes.process_name=sqltoolsps.exe OR Processes.process_name=powershell.exe OR Processes.process_name=powershell_ise.exe OR Processes.original_file_name=pwsh.dll OR Processes.original_file_name=PowerShell.EXE OR Processes.original_file_name=powershell_ise.EXE)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_procdump",
|
|
"definition": "(Processes.process_name=procdump.exe OR Processes.process_name=procdump64.exe OR Processes.original_file_name=procdump)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_psexec",
|
|
"definition": "(Processes.process_name=psexec.exe OR Processes.process_name=psexec64.exe OR Processes.original_file_name=psexec.c)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_rclone",
|
|
"definition": "(Processes.original_file_name=rclone.exe OR Processes.process_name=rclone.exe)",
|
|
"description": "Matches the process with its original file name."
|
|
},
|
|
{
|
|
"name": "process_reg",
|
|
"definition": "(Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_regasm",
|
|
"definition": "(Processes.process_name=regasm.exe OR Processes.original_file_name=RegAsm.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_regsvcs",
|
|
"definition": "(Processes.process_name=regsvcs.exe OR Processes.original_file_name=RegSvcs.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_regsvr32",
|
|
"definition": "(Processes.process_name=regsvr32.exe OR Processes.original_file_name=REGSVR32.EXE)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_route",
|
|
"definition": "(Processes.process_name=route.exe OR Processes.original_file_name=route.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_runas",
|
|
"definition": "(Processes.process_name=runas.exe OR Processes.original_file_name=runas.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_rundll32",
|
|
"definition": "(Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_schtasks",
|
|
"definition": "(Processes.process_name=schtasks.exe OR Processes.original_file_name=schtasks.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_sdelete",
|
|
"definition": "(Processes.process_name=sdelete.exe OR Processes.original_file_name=sdelete.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_setspn",
|
|
"definition": "(Processes.process_name=setspn.exe OR Processes.original_file_name=setspn.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_verclsid",
|
|
"definition": "(Processes.process_name=verclsid.exe OR Processes.original_file_name=verclsid.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_vssadmin",
|
|
"definition": "(Processes.process_name=vssadmin.exe OR Processes.original_file_name=VSSADMIN.EXE)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_wbadmin",
|
|
"definition": "(Processes.process_name=wbadmin.exe OR Processes.original_file_name=WBADMIN.EXE)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "process_wmic",
|
|
"definition": "(Processes.process_name=wmic.exe OR Processes.original_file_name=wmic.exe)",
|
|
"description": "Matches the process with its original file name, data for this macro came from https://strontic.github.io/"
|
|
},
|
|
{
|
|
"name": "prohibited_apps_launching_cmd",
|
|
"definition": "| inputlookup prohibited_apps_launching_cmd | rename prohibited_applications as parent_process_name | eval parent_process_name=\"*\" . parent_process_name | table parent_process_name",
|
|
"description": "This macro outputs a list of process that should not be the parent process of cmd.exe"
|
|
},
|
|
{
|
|
"name": "prohibited_softwares",
|
|
"definition": "lookup prohibited_softwares app as process_name OUTPUT is_prohibited | search is_prohibited=True",
|
|
"description": "This macro limits the output to process_names that have been marked as prohibited"
|
|
},
|
|
{
|
|
"name": "ransomware_extensions",
|
|
"definition": "lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Name | search Name !=False",
|
|
"description": "This macro limits the output to files that have extensions associated with ransomware"
|
|
},
|
|
{
|
|
"name": "ransomware_notes",
|
|
"definition": "lookup ransomware_notes_lookup ransomware_notes as file_name OUTPUT status as \"Known Ransomware Notes\" | search \"Known Ransomware Notes\"=True",
|
|
"description": "This macro limits the output to files that have been identified as a ransomware note"
|
|
},
|
|
{
|
|
"name": "remove_valid_domains",
|
|
"definition": "eval domain=trim(domain,\"*\") | search NOT[| inputlookup domains] NOT[ |inputlookup cim_corporate_email_domain_lookup] NOT[inputlookup cim_corporate_web_domain_lookup] | eval domain=\"*\"+domain+\"*\"",
|
|
"description": "This macro removes valid domains from the output"
|
|
},
|
|
{
|
|
"name": "s3_accesslogs",
|
|
"definition": "sourcetype=aws:s3:accesslogs",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch vpc logs. Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "security_content_ctime",
|
|
"definition": "convert timeformat=\"%Y-%m-%dT%H:%M:%S\" ctime($field$)",
|
|
"description": "convert epoch time to string",
|
|
"arguments": [
|
|
"field"
|
|
]
|
|
},
|
|
{
|
|
"name": "security_content_summariesonly",
|
|
"definition": "summariesonly=false allow_old_summaries=true",
|
|
"description": "search data model's summaries only"
|
|
},
|
|
{
|
|
"name": "security_group_api_calls",
|
|
"definition": "(eventName=AuthorizeSecurityGroupIngress OR eventName=CreateSecurityGroup OR eventName=DeleteSecurityGroup OR eventName=DescribeClusterSecurityGroups OR eventName=DescribeDBSecurityGroups OR eventName=DescribeSecurityGroupReferences OR eventName=DescribeSecurityGroups OR eventName=DescribeStaleSecurityGroups OR eventName=RevokeSecurityGroupIngress OR eventName=UpdateSecurityGroupRuleDescriptionsIngress)",
|
|
"description": "This macro is a list of AWS event names associated with security groups"
|
|
},
|
|
{
|
|
"name": "signals",
|
|
"definition": "index=signals",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "stream_dns",
|
|
"definition": "sourcetype=stream:dns",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "stream_http",
|
|
"definition": "sourcetype=stream:http",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "stream_tcp",
|
|
"definition": "sourcetype=stream:tcp",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "suspicious_email_attachments",
|
|
"definition": "lookup update=true is_suspicious_file_extension_lookup file_name OUTPUT suspicious | search suspicious=true",
|
|
"description": "This macro limits the output to email attachments that have suspicious extensions"
|
|
},
|
|
{
|
|
"name": "suspicious_writes",
|
|
"definition": "lookup suspicious_writes_lookup file as file_name OUTPUT note as \"Reference\" | search \"Reference\" != False",
|
|
"description": "This macro limites the output to file names that have been marked as suspicious"
|
|
},
|
|
{
|
|
"name": "sysmon",
|
|
"definition": "sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=Syslog:Linux-Sysmon/Operational",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "system_network_configuration_discovery_tools",
|
|
"definition": "(process_name= \"arp.exe\" OR process_name= \"at.exe\" OR process_name= \"attrib.exe\" OR process_name= \"cscript.exe\" OR process_name= \"dsquery.exe\" OR process_name= \"hostname.exe\" OR process_name= \"ipconfig.exe\" OR process_name= \"mimikatz.exe\" OR process_name= \"nbstat.exe\" OR process_name= \"net.exe\" OR process_name= \"netsh.exe\" OR process_name= \"nslookup.exe\" OR process_name= \"ping.exe\" OR process_name= \"quser.exe\" OR process_name= \"qwinsta.exe\" OR process_name= \"reg.exe\" OR process_name= \"runas.exe\" OR process_name= \"sc.exe\" OR process_name= \"schtasks.exe\" OR process_name= \"ssh.exe\" OR process_name= \"systeminfo.exe\" OR process_name= \"taskkill.exe\" OR process_name= \"telnet.exe\" OR process_name= \"tracert.exe\" OR process_name=\"wscript.exe\" OR process_name= \"xcopy.exe\")",
|
|
"description": "This macro is a list of process that can be used to discover the network configuration"
|
|
},
|
|
{
|
|
"name": "uncommon_processes",
|
|
"definition": "lookup update=true lookup_uncommon_processes_default process_name as process_name outputnew uncommon_default,category_default,analytic_story_default,kill_chain_phase_default,mitre_attack_default | lookup update=true lookup_uncommon_processes_local process_name as process_name outputnew uncommon_local,category_local,analytic_story_local,kill_chain_phase_local,mitre_attack_local | eval uncommon = coalesce(uncommon_default, uncommon_local), analytic_story = coalesce(analytic_story_default, analytic_story_local), category=coalesce(category_default, category_local), kill_chain_phase=coalesce(kill_chain_phase_default, kill_chain_phase_local), mitre_attack=coalesce(mitre_attack_default, mitre_attack_local) | fields - analytic_story_default, analytic_story_local, category_default, category_local, kill_chain_phase_default, kill_chain_phase_local, mitre_attack_default, mitre_attack_local, uncommon_default, uncommon_local | search uncommon=true",
|
|
"description": "This macro limits the output to processes that have been marked as uncommon"
|
|
},
|
|
{
|
|
"name": "windows_shells",
|
|
"definition": "(Processes.process_name=cmd.exe OR Processes.process_name=powershell.exe)",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "wineventlog_security",
|
|
"definition": "eventtype=wineventlog_security",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "wineventlog_system",
|
|
"definition": "eventtype=wineventlog_system",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "wineventlog_task_scheduler",
|
|
"definition": "source=\"WinEventLog:Microsoft-Windows-TaskScheduler/Operational\"",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "wmi",
|
|
"definition": "sourcetype=\"wineventlog:microsoft-windows-wmi-activity/operational\"",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "zeek_rpc",
|
|
"definition": "index=zeek sourcetype=\"zeek:rpc:json\"",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
},
|
|
{
|
|
"name": "zeek_ssl",
|
|
"definition": "index=zeek sourcetype=\"zeek:ssl:json\"",
|
|
"description": "customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent."
|
|
}
|
|
] |