Nasreddine Bencherchali 6cc12a9b29 Analytic Enhancements and Fixes (#3850) ...

* update `Windows LOLBAS Executed Outside Expected Path`

* Update suspicious_email_attachment_extensions.yml

* update susp extension lookup

* some additional fixes

* Update system_processes_run_from_unexpected_locations.yml

* small changes

* Update detect_rtlo_in_file_name.yml

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>

2026-01-12 18:36:12 +05:30

..

__mlspl_detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.mlmodel

Adding missing lookup files

2023-06-12 13:56:20 -07:00

__mlspl_detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml

first batch of updates to

2024-12-23 15:14:19 -08:00

__mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.mlmodel

adding detect suspicious dns txt records using pretrained model in dsdl

2023-01-17 15:26:01 -08:00

__mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml

first batch of updates to

2024-12-23 15:14:19 -08:00

__mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl.mlmodel

Detection name update

2023-02-07 15:31:48 +01:00

__mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml

first batch of updates to

2024-12-23 15:14:19 -08:00

__mlspl_pretrained_dga_model_dsdl.mlmodel

changing files

2022-09-28 12:36:40 -07:00

__mlspl_pretrained_dga_model_dsdl.yml

first batch of updates to

2024-12-23 15:14:19 -08:00

__mlspl_unusual_commandline_detection.mlmodel

Updating mlmodel to 5.3.x specification as well as the test apparatus

2022-01-25 21:42:16 -05:00

__mlspl_unusual_commandline_detection.yml

Removing default match from lookups

2025-03-26 11:01:05 -05:00

3cx_ioc_domains.csv

dns

2023-03-30 12:15:41 -06:00

3cx_ioc_domains.yml

Removing default match from lookups

2025-03-26 11:01:05 -05:00

ace_access_rights_lookup.csv

adding AD ACL and GPO related detections

2024-07-02 11:52:21 +10:00

ace_access_rights_lookup.yml

first batch of updates to

2024-12-23 15:14:19 -08:00

ace_flag_lookup.csv

adding AD ACL and GPO related detections

2024-07-02 11:52:21 +10:00

ace_flag_lookup.yml

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

ace_type_lookup.csv

adding AD ACL and GPO related detections

2024-07-02 11:52:21 +10:00

ace_type_lookup.yml

first batch of updates to

2024-12-23 15:14:19 -08:00

advanced_audit_policy_guids.csv

renaming advanced audit policy guids lookup

2023-02-13 12:03:49 -05:00

advanced_audit_policy_guids.yml

Removing default match from lookups

2025-03-26 11:01:05 -05:00

api_call_by_user_baseline.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

applockereventcodes.csv

ESCU Release Branch - v4.30.0

2024-04-17 20:44:56 +00:00

applockereventcodes.yml

Removing default match from lookups

2025-03-26 11:01:05 -05:00

asr_rules.csv

update: lookups with additional data

2025-01-30 20:33:48 +01:00

asr_rules.yml

Removing default match from lookups

2025-03-26 11:01:05 -05:00

attacker_tools.csv

update time 🚀

2025-06-30 13:55:55 +02:00

attacker_tools.yml

update time 🚀

2025-06-30 13:55:55 +02:00

aws_service_accounts.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

aws_service_accounts.yml

first batch of updates to

2024-12-23 15:14:19 -08:00

baseline_blocked_outbound_connections.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

baseline_blocked_outbound_connections.yml

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

brandmonitoring_lookup.csv

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

brandmonitoring_lookup.yml

Removing default match from lookups

2025-03-26 11:01:05 -05:00

browser_app_list.csv

quasar_and_loader

2025-07-16 10:23:20 +02:00

browser_app_list.yml

quasar_and_loader

2025-07-17 16:09:40 +02:00

builtin_groups_lookup.csv

update: lookups with additional data

2025-01-30 20:33:48 +01:00

builtin_groups_lookup.yml

update: lookups with additional data

2025-01-30 20:33:48 +01:00

char_conversion_matrix.csv

Release 4.19.0

2024-01-10 17:21:34 +00:00

char_conversion_matrix.yml

Removing default match from lookups

2025-03-26 11:01:05 -05:00

cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools.csv

add Cisco Secure Firewall - Remote Access Software Usage Traffic

2025-05-28 19:33:18 +02:00

cisco_secure_firewall_appid_remote_mgmt_and_desktop_tools.yml

add Cisco Secure Firewall - Remote Access Software Usage Traffic

2025-05-28 19:33:18 +02:00

cisco_secure_firewall_filetype_lookup.csv

cisco secure firewall detections - second batch

2025-04-09 12:33:51 +02:00

cisco_secure_firewall_filetype_lookup.yml

New Rules & Updates - Oct 25 (#3726)

2025-10-24 14:19:48 -07:00

cisco_snort_ids_to_threat_mapping.csv

add lokibot

2025-12-08 14:06:28 +01:00

cisco_snort_ids_to_threat_mapping.yml

update snort lookup

2025-12-08 13:53:41 +01:00

cloud_instances_enough_data.yml

Removing default match from lookups

2025-03-26 11:01:05 -05:00

decommissioned_buckets.yml

Removing default match from lookups

2025-03-26 11:01:05 -05:00

discovered_dns_records.csv

app inspect failures fixes

2020-12-08 14:56:39 -08:00

discovered_dns_records.yml

Removing default match from lookups

2025-03-26 11:01:05 -05:00

domain_admins.csv

adding new detection - diamond ticket

2023-10-06 15:46:36 -04:00

domain_admins.yml

Second round of lookup file cleanup

2024-12-23 15:23:52 -08:00

domains.csv

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

domains.yml

Second round of lookup file cleanup

2024-12-23 15:23:52 -08:00

dynamic_dns_providers_default.csv

update: lookups with additional data

2025-01-30 20:33:48 +01:00

dynamic_dns_providers_default.yml

update: lookups with additional data

2025-01-30 20:33:48 +01:00

dynamic_dns_providers_local.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

dynamic_dns_providers_local.yml

Second round of lookup file cleanup

2024-12-23 15:23:52 -08:00

hijacklibs_loaded.csv

ESCU Release Branch v4.27.0

2024-03-20 20:01:18 +00:00

hijacklibs_loaded.yml

Adding default match back to lookups where used

2025-03-26 13:03:42 -05:00

hijacklibs.csv

T1003.001 Update

2022-08-25 08:04:20 -06:00

hijacklibs.yml

Removing default match from lookups

2025-03-26 11:01:05 -05:00

images_to_repository.csv

updated detections

2021-09-06 10:59:00 +02:00

images_to_repository.yml

Second round of lookup file cleanup

2024-12-23 15:23:52 -08:00

is_net_windows_file.csv

Analytic Enhancements and Fixes (#3850)

2026-01-12 18:36:12 +05:30

is_net_windows_file.yml

Removing default match from lookups

2025-03-26 11:01:05 -05:00

is_nirsoft_software.csv

New Rules & Updates - Oct 25 (#3726)

2025-10-24 14:19:48 -07:00

is_nirsoft_software.yml

New Rules & Updates - Oct 25 (#3726)

2025-10-24 14:19:48 -07:00

is_suspicious_file_extension_lookup.csv

Analytic Enhancements and Fixes (#3850)

2026-01-12 18:36:12 +05:30

is_suspicious_file_extension_lookup.yml

Analytic Enhancements and Fixes (#3850)

2026-01-12 18:36:12 +05:30

is_windows_system_file.csv

Analytic Enhancements and Fixes (#3850)

2026-01-12 18:36:12 +05:30

is_windows_system_file.yml

Analytic Enhancements and Fixes (#3850)

2026-01-12 18:36:12 +05:30

k8s_container_network_io_baseline.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

k8s_container_network_io_ratio_baseline.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

k8s_process_resource_baseline.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

k8s_process_resource_ratio_baseline.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

legit_domains.csv

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

legit_domains.yml

another round of lookup file updates

2024-12-23 15:45:58 -08:00

linux_tool_discovery_process.csv

combined the rest 2

2022-02-17 16:28:19 -08:00

linux_tool_discovery_process.yml

Removing default match from lookups

2025-03-26 11:01:05 -05:00

local_file_inclusion_paths.csv

new detection

2021-08-23 13:07:23 +02:00

local_file_inclusion_paths.yml

Removing default match from lookups

2025-03-26 11:01:05 -05:00

lolbas_file_path.csv

Analytic Enhancements and Fixes (#3850)

2026-01-12 18:36:12 +05:30

lolbas_file_path.yml

Analytic Enhancements and Fixes (#3850)

2026-01-12 18:36:12 +05:30

loldrivers.csv

Bespoke Drivers

2022-12-31 14:14:11 -07:00

loldrivers.yml

Removing default match from lookups

2025-03-26 11:01:05 -05:00

lookup_rare_process_allow_list_default.csv

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

lookup_rare_process_allow_list_default.yml

Removing default match from lookups

2025-03-26 11:01:05 -05:00

lookup_rare_process_allow_list_local.csv

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

lookup_rare_process_allow_list_local.yml

Removing default match from lookups

2025-03-26 11:01:05 -05:00

lookup_uncommon_processes_default.csv

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

lookup_uncommon_processes_default.yml

another round of lookup file updates

2024-12-23 15:45:58 -08:00

lookup_uncommon_processes_local.csv

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

lookup_uncommon_processes_local.yml

another round of lookup file updates

2024-12-23 15:45:58 -08:00

malicious_powershell_strings.csv

updating lookup

2025-03-03 16:20:52 -08:00

malicious_powershell_strings.yml

updating lookup

2025-03-03 16:20:52 -08:00

malware_user_agents.csv

Detections for default user agents (#3842)

2026-01-07 09:34:04 +05:30

malware_user_agents.yml

Detections for default user agents (#3842)

2026-01-07 09:34:04 +05:30

mandatory_job_for_workflow.csv

circle ci detecction

2021-09-02 10:42:01 +02:00

mandatory_job_for_workflow.yml

More cleanup of lookups

2024-12-23 16:06:48 -08:00

mandatory_step_for_job.csv

circle ci detecction

2021-09-01 17:54:38 +02:00

mandatory_step_for_job.yml

another round of lookup file updates

2024-12-23 15:45:58 -08:00

msad_guid_lookup.csv

adding AD ACL and GPO related detections

2024-07-02 11:52:21 +10:00

msad_guid_lookup.yml

another round of lookup file updates

2024-12-23 15:45:58 -08:00

network_acl_activity_baseline.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

network_acl_activity_baseline.yml

finish lookup cleanup

2025-01-03 11:05:52 -08:00

previously_seen_api_calls_from_user_roles.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_aws_cross_account_activity.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_aws_regions.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_cloud_api_calls_per_user_role.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_cloud_compute_creations_by_user.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_cloud_compute_images.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_cloud_compute_instance_types.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_cloud_instance_modifications_by_user.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_cloud_provisioning_activity_sources.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_cloud_regions.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_cmd_line_arguments.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

previously_seen_cmd_line_arguments.yml

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

previously_seen_ec2_amis_lookup.yml

Fix more errors with missing lookups, baselines, and detections

2025-01-16 10:45:46 -08:00

previously_seen_ec2_instance_types_lookup.yml

Fix more errors with missing lookups, baselines, and detections

2025-01-16 10:45:46 -08:00

previously_seen_ec2_launches_by_user_lookup.yml

Fix more errors with missing lookups, baselines, and detections

2025-01-16 10:45:46 -08:00

previously_seen_ec2_modifications_by_user.csv

Added lookup files that weren't there

2019-09-30 16:07:44 -07:00

previously_seen_ec2_modifications_by_user.yml

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

previously_seen_gcp_storage_access_from_remote_ip.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_provisioning_activity_src.yml

progress on input/output lookup

2025-01-03 16:35:39 -08:00

previously_seen_running_windows_services.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_s3_access_from_remote_ip.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

previously_seen_users_console_logins.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

privileged_azure_ad_roles.csv

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

privileged_azure_ad_roles.yml

Removing default match from lookups

2025-03-26 11:01:05 -05:00

prohibited_apps_launching_cmd.csv

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

prohibited_apps_launching_cmd.yml

finish lookup cleanup

2025-01-03 11:05:52 -08:00

prohibited_processes.csv

Updated macro definition in detections, investigations, and baselines to just be a list

2019-09-30 13:53:25 -07:00

prohibited_processes.yml

first batch of updates to

2024-12-23 15:14:19 -08:00

pua_named_pipes.csv

Add tuoni content and named pipe detection (#3816)

2025-12-08 21:25:09 +01:00

pua_named_pipes.yml

Add tuoni content and named pipe detection (#3816)

2025-12-08 21:25:09 +01:00

pua_user_agents.csv

Detections for default user agents (#3842)

2026-01-07 09:34:04 +05:30

pua_user_agents.yml

Detections for default user agents (#3842)

2026-01-07 09:34:04 +05:30

ransomware_extensions_lookup.csv

Fix Issues & Updates (#3705)

2025-10-13 09:18:21 -07:00

ransomware_extensions_lookup.yml

Fix Issues & Updates (#3705)

2025-10-13 09:18:21 -07:00

ransomware_notes_lookup.csv

interlock_ransomware

2025-07-29 12:31:56 +02:00

ransomware_notes_lookup.yml

interlock_ransomware

2025-07-28 11:13:15 +02:00

remote_access_software_exceptions.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

remote_access_software.csv

fix: addtl remote_utility typo in remote_access_software.csv

2025-04-04 11:32:32 -04:00

remote_access_software.yml

chore: update lookup date and version

2025-04-04 11:32:45 -04:00

rmm_user_agents.csv

Detections for default user agents (#3842)

2026-01-07 09:34:04 +05:30

rmm_user_agents.yml

Detections for default user agents (#3842)

2026-01-07 09:34:04 +05:30

s3_deletion_baseline.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

scripting_tools_user_agents.csv

HTTP Request Smuggling (#3731)

2025-10-21 14:08:57 -07:00

scripting_tools_user_agents.yml

HTTP Request Smuggling (#3731)

2025-10-21 14:08:57 -07:00

security_group_activity_baseline.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00

security_services_lookup.csv

update: lookups with additional data

2025-01-30 20:33:48 +01:00

security_services_lookup.yml

Removing default match from lookups

2025-03-26 11:01:05 -05:00

sslbl_ssl_certificate_blacklist.csv

cisco secure firewall detections - first batch

2025-04-03 14:21:27 +02:00

sslbl_ssl_certificate_blacklist.yml

update lookup name

2025-04-03 14:24:53 +02:00

suspicious_c2_named_pipes.csv

Add tuoni content and named pipe detection (#3816)

2025-12-08 21:25:09 +01:00

suspicious_c2_named_pipes.yml

Add tuoni content and named pipe detection (#3816)

2025-12-08 21:25:09 +01:00

suspicious_c2_user_agents.csv

Detections for default user agents (#3842)

2026-01-07 09:34:04 +05:30

suspicious_c2_user_agents.yml

Detections for default user agents (#3842)

2026-01-07 09:34:04 +05:30

suspicious_named_pipes.csv

Add tuoni content and named pipe detection (#3816)

2025-12-08 21:25:09 +01:00

suspicious_named_pipes.yml

Add tuoni content and named pipe detection (#3816)

2025-12-08 21:25:09 +01:00

suspicious_ports_list.csv

Update suspicious_ports_list.csv

2025-07-01 23:07:46 +02:00

suspicious_ports_list.yml

add new detections, story and other cool things

2025-07-01 23:04:48 +02:00

suspicious_rmm_named_pipes.csv

Add tuoni content and named pipe detection (#3816)

2025-12-08 21:25:09 +01:00

suspicious_rmm_named_pipes.yml

Add tuoni content and named pipe detection (#3816)

2025-12-08 21:25:09 +01:00

suspicious_writes_lookup.csv

more cleanup of lookups to follow new format.

2025-01-03 10:27:49 -08:00

suspicious_writes_lookup.yml

Removing default match from lookups

2025-03-26 11:01:05 -05:00

threat_snort_count.csv

updating IDs

2025-09-24 11:20:12 -07:00

threat_snort_count.yml

updating IDs

2025-09-24 11:20:12 -07:00

typo_squatted_python_packages.csv

the final countdown

2025-07-06 02:57:39 +02:00

typo_squatted_python_packages.yml

the final countdown

2025-07-06 02:57:39 +02:00

windows_protocol_handlers.csv

Windows Protocol Handler

2022-07-12 14:43:39 -06:00

windows_protocol_handlers.yml

Removing default match from lookups

2025-03-26 11:01:05 -05:00

windows_suspicious_services.csv

Update windows_suspicious_services.csv

2025-02-19 15:29:33 -05:00

windows_suspicious_services.yml

Merge branch 'develop' into win_sus_service_fix

2025-03-28 09:50:36 -07:00

windows_suspicious_tasks.csv

Add files via upload

2025-02-07 13:34:34 -05:00

windows_suspicious_tasks.yml

Removing default match from lookups

2025-03-26 11:01:05 -05:00

zoom_first_time_child_process.yml

remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key.

2025-01-03 13:58:18 -08:00