Files

 develop

/

macros

/

Copy path

Directory actions

More options

Directory actions

More options

Latest commit

Patrick Bareiss

Merge branch 'develop' into output_normalization_endpoint

Mar 19, 2025

641c590 · Mar 19, 2025

History

History

This branch is 169 commits behind splunk/security_content:develop.

/

macros

/

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
admon.yml		admon.yml	fix env typo in macros	Nov 26, 2024
amazon_security_lake.yml		amazon_security_lake.yml	new detection	Jan 8, 2025
appdynamics_security.yml		appdynamics_security.yml	adding draft detections	Feb 4, 2025
applocker.yml		applocker.yml	ESCU Release Branch - v4.30.0	Apr 17, 2024
aws_cloudwatchlogs_eks.yml		aws_cloudwatchlogs_eks.yml	fix env typo in macros	Nov 26, 2024
aws_config.yml		aws_config.yml	fix env typo in macros	Nov 26, 2024
aws_description.yml		aws_description.yml	fix env typo in macros	Nov 26, 2024
aws_ecr_users.yml		aws_ecr_users.yml	container upload aws ecr	Aug 19, 2021
aws_ecr_users_asl.yml		aws_ecr_users_asl.yml	Release Branch - ESCU v4.32.0	May 22, 2024
aws_s3_accesslogs.yml		aws_s3_accesslogs.yml	fix env typo in macros	Nov 26, 2024
aws_securityhub_finding.yml		aws_securityhub_finding.yml	fix env typo in macros	Nov 26, 2024
aws_securityhub_firehose.yml		aws_securityhub_firehose.yml	fix env typo in macros	Nov 26, 2024
azure_audit.yml		azure_audit.yml	fix env typo in macros	Nov 26, 2024
azure_monitor_aad.yml		azure_monitor_aad.yml	fix env typo in macros	Nov 26, 2024
azure_monitor_activity.yml		azure_monitor_activity.yml	Uploading new detections	Jan 6, 2025
azuread.yml		azuread.yml	fix env typo in macros	Nov 26, 2024
base64decode.yml		base64decode.yml	Release 4.19.0	Jan 10, 2024
bootloader_inventory.yml		bootloader_inventory.yml	fix env typo in macros	Nov 26, 2024
brand_abuse_dns.yml		brand_abuse_dns.yml	Changed json to yml	Oct 16, 2019
brand_abuse_email.yml		brand_abuse_email.yml	Changed json to yml	Oct 16, 2019
brand_abuse_web.yml		brand_abuse_web.yml	Changed json to yml	Oct 16, 2019
capi2_operational.yml		capi2_operational.yml	fix env typo in macros	Nov 26, 2024
certificateservices_lifecycle.yml		certificateservices_lifecycle.yml	fix env typo in macros	Nov 26, 2024
circleci.yml		circleci.yml	fix env typo in macros	Nov 26, 2024
cisco_ai_defense.yml		cisco_ai_defense.yml	updaing for validate	Feb 14, 2025
cisco_networks.yml		cisco_networks.yml	fix env typo in macros	Nov 26, 2024
cloud_api_calls_from_previously_unseen_user_roles_activity_window.yml		cloud_api_calls_from_previously_unseen_user_roles_activity_window.yml	single and double quote order issue	Sep 23, 2020
cloudtrail.yml		cloudtrail.yml	fix env typo in macros	Nov 26, 2024
cloudwatch_eks.yml		cloudwatch_eks.yml	fix env typo in macros	Nov 26, 2024
cloudwatch_vpc.yml		cloudwatch_vpc.yml	fix env typo in macros	Nov 26, 2024
cloudwatchlogs_vpcflow.yml		cloudwatchlogs_vpcflow.yml	fix env typo in macros	Nov 26, 2024
crowdstrike_identities.yml		crowdstrike_identities.yml	fix env typo in macros	Nov 26, 2024
crowdstrike_stream.yml		crowdstrike_stream.yml	fix env typo in macros	Nov 26, 2024
crushftp.yml		crushftp.yml	fix env typo in macros	Nov 26, 2024
driverinventory.yml		driverinventory.yml	fix env typo in macros	Nov 26, 2024
dynamic_dns_providers.yml		dynamic_dns_providers.yml	Release Branch ESCU 4.23.0	Jan 30, 2024
dynamic_dns_web_traffic.yml		dynamic_dns_web_traffic.yml	Changed json to yml	Oct 16, 2019
ec2_modification_api_calls.yml		ec2_modification_api_calls.yml	Removed a few API calls that are not really modifications	Aug 18, 2020
evilginx_phishlets_0365.yml		evilginx_phishlets_0365.yml	Changed json to yml	Oct 16, 2019
evilginx_phishlets_amazon.yml		evilginx_phishlets_amazon.yml	Changed json to yml	Oct 16, 2019
evilginx_phishlets_aws.yml		evilginx_phishlets_aws.yml	Changed json to yml	Oct 16, 2019
evilginx_phishlets_facebook.yml		evilginx_phishlets_facebook.yml	Changed json to yml	Oct 16, 2019
evilginx_phishlets_github.yml		evilginx_phishlets_github.yml	Changed json to yml	Oct 16, 2019
evilginx_phishlets_google.yml		evilginx_phishlets_google.yml	Changed json to yml	Oct 16, 2019
evilginx_phishlets_outlook.yml		evilginx_phishlets_outlook.yml	Changed json to yml	Oct 16, 2019
f5_bigip_rogue.yml		f5_bigip_rogue.yml	remove index	Dec 18, 2024
fillnull_config.yml		fillnull_config.yml	Release Branch - ESCU v4.34.0	Jun 26, 2024
filter_rare_process_allow_list.yml		filter_rare_process_allow_list.yml	Changed the language in some of the descriptions	Jan 22, 2021
github.yml		github.yml	fix env typo in macros	Nov 26, 2024
github_enterprise.yml		github_enterprise.yml	improvements	Jan 15, 2025
github_known_users.yml		github_known_users.yml	github detection	Sep 1, 2021
github_organizations.yml		github_organizations.yml	new github detections	Jan 16, 2025
google_gcp_pubnet_message.yml		google_gcp_pubnet_message.yml	fix env typo in macros	Nov 26, 2024
google_gcp_pubsub_message.yml		google_gcp_pubsub_message.yml	fix env typo in macros	Nov 26, 2024
gsuite_calendar.yml		gsuite_calendar.yml	fix env typo in macros	Nov 26, 2024
gsuite_drive.yml		gsuite_drive.yml	fix env typo in macros	Nov 26, 2024
gsuite_gmail.yml		gsuite_gmail.yml	fix env typo in macros	Nov 26, 2024
gws_login_mfa_methods.yml		gws_login_mfa_methods.yml	fix env typo in macros	Nov 26, 2024
gws_reports_admin.yml		gws_reports_admin.yml	fix env typo in macros	Nov 26, 2024
gws_reports_login.yml		gws_reports_login.yml	fix env typo in macros	Nov 26, 2024
iis_get_webglobalmodule.yml		iis_get_webglobalmodule.yml	fix env typo in macros	Nov 26, 2024
iis_operational_logs.yml		iis_operational_logs.yml	fix env typo in macros	Nov 26, 2024
important_audit_policy_subcategory_guids.yml		important_audit_policy_subcategory_guids.yml	feat: add new analytic story and analytic	Feb 19, 2025
is_net_windows_file_macro.yml		is_net_windows_file_macro.yml	ESCU Release v4.31.0	May 8, 2024
is_nirsoft_software_macro.yml		is_nirsoft_software_macro.yml	ESCU Release v4.31.0	May 8, 2024
is_windows_system_file_macro.yml		is_windows_system_file_macro.yml	ESCU Release v4.31.0	May 8, 2024
ivanti_vtm_audit.yml		ivanti_vtm_audit.yml	fix env typo in macros	Nov 26, 2024
kube_allowed_images.yml		kube_allowed_images.yml	Release v4.18.0	Dec 20, 2023
kube_allowed_locations.yml		kube_allowed_locations.yml	ESCU Release v4.31.0	May 8, 2024
kube_allowed_user_agents.yml		kube_allowed_user_agents.yml	Release v4.18.0	Dec 20, 2023
kube_allowed_user_groups.yml		kube_allowed_user_groups.yml	Release v4.18.0	Dec 20, 2023
kube_allowed_user_names.yml		kube_allowed_user_names.yml	Release v4.18.0	Dec 20, 2023
kube_audit.yml		kube_audit.yml	fix env typo in macros	Nov 26, 2024
kube_container_falco.yml		kube_container_falco.yml	fix env typo in macros	Nov 26, 2024
kube_objects_events.yml		kube_objects_events.yml	fix env typo in macros	Nov 26, 2024
kubernetes_azure.yml		kubernetes_azure.yml	fix env typo in macros	Nov 26, 2024
kubernetes_container_controller.yml		kubernetes_container_controller.yml	fix env typo in macros	Nov 26, 2024
kubernetes_metrics.yml		kubernetes_metrics.yml	fix env typo in macros	Nov 26, 2024
linux_auditd.yml		linux_auditd.yml	auditd_detection_updates	Feb 20, 2025
linux_auditd_normalized_execve_process.yml		linux_auditd_normalized_execve_process.yml	fix env typo in macros	Nov 26, 2024
linux_auditd_normalized_proctitle_process.yml		linux_auditd_normalized_proctitle_process.yml	fix env typo in macros	Nov 26, 2024
linux_hosts.yml		linux_hosts.yml	fix env typo in macros	Nov 26, 2024
linux_shells.yml		linux_shells.yml	fix env typo in macros	Nov 26, 2024
moveit_sftp_logs.yml		moveit_sftp_logs.yml	fix env typo in macros	Nov 26, 2024
ms365_defender_incident_alerts.yml		ms365_defender_incident_alerts.yml	fix env typo in macros	Nov 26, 2024
ms_defender.yml		ms_defender.yml	update: windows event log macros	Jan 30, 2025
ms_defender_atp_alerts.yml		ms_defender_atp_alerts.yml	fix env typo in macros	Nov 26, 2024
msexchange_management.yml		msexchange_management.yml	fix env typo in macros	Nov 26, 2024
netbackup.yml		netbackup.yml	fix env typo in macros	Nov 26, 2024
network_acl_events.yml		network_acl_events.yml	naming updates, jinja macros updates	Dec 16, 2019
nginx_access_logs.yml		nginx_access_logs.yml	ESCU v4.26.0 Release branch	Mar 6, 2024
normalized_service_binary_field.yml		normalized_service_binary_field.yml	analytics_enhancement	Feb 3, 2025
ntlm_audit.yml		ntlm_audit.yml	fix env typo in macros	Nov 26, 2024
o365_graph.yml		o365_graph.yml	fix env typo in macros	Nov 26, 2024
o365_management_activity.yml		o365_management_activity.yml	fix env typo in macros	Nov 26, 2024
o365_messagetrace.yml		o365_messagetrace.yml	Update o365_messagetrace.yml	Jan 23, 2025
o365_suspect_search_terms_regex.yml		o365_suspect_search_terms_regex.yml	Update macro	Mar 17, 2025
okta.yml		okta.yml	fix env typo in macros	Nov 26, 2024
oldsummaries_config.yml		oldsummaries_config.yml	Release Branch - ESCU v4.34.0	Jun 26, 2024
osquery_macro.yml		osquery_macro.yml	fix env typo in macros	Nov 26, 2024
osquery_process.yml		osquery_process.yml	fix env typo in macros	Nov 26, 2024
papercutng.yml		papercutng.yml	fix env typo in macros	Nov 26, 2024
pingid.yml		pingid.yml	fix env typo in macros	Nov 26, 2024
potential_password_in_username_false_positive_reduction.yml		potential_password_in_username_false_positive_reduction.yml	map filter	Jun 21, 2022
potentially_malicious_code_on_cmdline_tokenize_score.yml		potentially_malicious_code_on_cmdline_tokenize_score.yml	Editing the macro to put the apply statement into the search query so…	Jan 27, 2022
powershell.yml		powershell.yml	update: windows event log macros	Jan 30, 2025
previously_seen_cloud_api_calls_per_user_role_forget_window.yml		previously_seen_cloud_api_calls_per_user_role_forget_window.yml	macro fixes	Sep 23, 2020
previously_seen_cloud_compute_creations_by_user_search_window_begin_offset.yml		previously_seen_cloud_compute_creations_by_user_search_window_begin_offset.yml	Macro fixes	Sep 23, 2020
previously_seen_cloud_compute_image_search_window_begin_offset.yml		previously_seen_cloud_compute_image_search_window_begin_offset.yml	Macro fixes	Sep 23, 2020
previously_seen_cloud_compute_images_forget_window.yml		previously_seen_cloud_compute_images_forget_window.yml	macro fixes	Sep 23, 2020
previously_seen_cloud_compute_instance_type_forget_window.yml		previously_seen_cloud_compute_instance_type_forget_window.yml	macro fixes	Sep 23, 2020
previously_seen_cloud_compute_instance_types_search_window_begin_offset.yml		previously_seen_cloud_compute_instance_types_search_window_begin_offset.yml	Macro fixes	Sep 23, 2020
previously_seen_cloud_instance_modifications_by_user_search_window_begin_offset.yml		previously_seen_cloud_instance_modifications_by_user_search_window_begin_offset.yml	Macro fixes	Sep 23, 2020
previously_seen_cloud_provisioning_activity_forget_window.yml		previously_seen_cloud_provisioning_activity_forget_window.yml	macro fixes	Sep 23, 2020
previously_seen_cloud_region_forget_window.yml		previously_seen_cloud_region_forget_window.yml	macro fixes	Sep 23, 2020
previously_seen_cloud_regions_search_window_begin_offset.yml		previously_seen_cloud_regions_search_window_begin_offset.yml	Macro fixes	Sep 23, 2020
previously_seen_windows_services_forget_window.yml		previously_seen_windows_services_forget_window.yml	macro fixes	Sep 23, 2020
previously_seen_windows_services_window.yml		previously_seen_windows_services_window.yml	bug fix	Feb 3, 2021
previously_seen_zoom_child_processes_forget_window.yml		previously_seen_zoom_child_processes_forget_window.yml	macro fixes	Sep 23, 2020
previously_seen_zoom_child_processes_window.yml		previously_seen_zoom_child_processes_window.yml	Macro fixes	Sep 23, 2020
previously_unseen_cloud_provisioning_activity_window.yml		previously_unseen_cloud_provisioning_activity_window.yml	Macro fixes	Sep 23, 2020
printservice.yml		printservice.yml	update: windows event log macros	Jan 30, 2025
process_auditpol.yml		process_auditpol.yml	feat: add auditpol macro	Feb 19, 2025
process_bitsadmin.yml		process_bitsadmin.yml	macro'd bitsadmin	Aug 17, 2021
process_certutil.yml		process_certutil.yml	macro'd certutil	Aug 17, 2021
process_cmd.yml		process_cmd.yml	macro'd wmic	Aug 17, 2021
process_copy.yml		process_copy.yml	privilege_escalation_persistence	Oct 5, 2021
process_csc.yml		process_csc.yml	ioc_detections	Nov 17, 2021
process_cscript.yml		process_cscript.yml	update powershell analytics	Jan 14, 2025
process_curl.yml		process_curl.yml	fixes	Oct 20, 2021
process_diskshadow.yml		process_diskshadow.yml	DiskShadow + Story Scaffolding	Feb 17, 2022
process_dllhost.yml		process_dllhost.yml	macros	Aug 18, 2021
process_dsquery.yml		process_dsquery.yml	macros	Aug 18, 2021
process_dxdiag.yml		process_dxdiag.yml	more_ioc_detections	Nov 19, 2021
process_esentutl.yml		process_esentutl.yml	Update process_esentutl.yml	Aug 18, 2021
process_fodhelper.yml		process_fodhelper.yml	macros	Aug 18, 2021
process_gpupdate.yml		process_gpupdate.yml	macros	Aug 18, 2021
process_hh.yml		process_hh.yml	macro'd hh	Aug 17, 2021
process_installutil.yml		process_installutil.yml	InstallUTIL 🍺	Nov 12, 2021
process_microsoftworkflowcompiler.yml		process_microsoftworkflowcompiler.yml	macros	Aug 18, 2021
process_msbuild.yml		process_msbuild.yml	msbuild and microsoftworkflowcompiler	Aug 19, 2021
process_mshta.yml		process_mshta.yml	macro'd mshta	Aug 17, 2021
process_msiexec.yml		process_msiexec.yml	T1218.007 - MSIExec	Jun 17, 2022
process_net.yml		process_net.yml	update to analytics using net	Jan 13, 2025
process_netsh.yml		process_netsh.yml	macro'd netsh	Aug 17, 2021
process_nltest.yml		process_nltest.yml	macros	Aug 18, 2021
process_ntdsutil.yml		process_ntdsutil.yml	macros	Aug 18, 2021
process_office_products.yml		process_office_products.yml	rba changes	Jan 22, 2025
process_office_products_parent.yml		process_office_products_parent.yml	update office macro	Jan 14, 2025
process_ping.yml		process_ping.yml	WhisperGateIsOpen	Jan 20, 2022
process_powershell.yml		process_powershell.yml	update powershell analytics	Jan 14, 2025
process_procdump.yml		process_procdump.yml	no longer need sysmon procdump - updated superior procdump	Sep 16, 2021
process_psexec.yml		process_psexec.yml	hh, mshta, and psexec	Sep 16, 2021
process_rclone.yml		process_rclone.yml	rookie mistake	Nov 30, 2021
process_reg.yml		process_reg.yml	macro'd reg cmd	Aug 17, 2021
process_regasm.yml		process_regasm.yml	macros	Aug 18, 2021
process_regedit.yml		process_regedit.yml	update reg analytics	Jan 15, 2025
process_regsvcs.yml		process_regsvcs.yml	macros	Aug 18, 2021
process_regsvr32.yml		process_regsvr32.yml	macro'd regsvr32	Aug 17, 2021
process_route.yml		process_route.yml	ioc_detections	Nov 17, 2021
process_runas.yml		process_runas.yml	ioc_detections	Nov 17, 2021
process_rundll32.yml		process_rundll32.yml	macrod rundll32	Aug 17, 2021
process_sc.yml		process_sc.yml	update to analytics using net	Jan 13, 2025
process_schtasks.yml		process_schtasks.yml	macros	Aug 18, 2021
process_sdelete.yml		process_sdelete.yml	privilege_escalation_persistence	Oct 6, 2021
process_setspn.yml		process_setspn.yml	HaagRoast	Oct 15, 2021
process_sqlcmd.yml		process_sqlcmd.yml	Haag's SQL Server Story Time: Tales of SQLCMD and Suspicious Queries 📚	Feb 14, 2025
process_verclsid.yml		process_verclsid.yml	privilege_escalation_persistence	Sep 29, 2021
process_vssadmin.yml		process_vssadmin.yml	macros	Aug 18, 2021
process_wbadmin.yml		process_wbadmin.yml	macros	Aug 18, 2021
process_wermgr.yml		process_wermgr.yml	qakbot_2	Oct 27, 2022
process_wmic.yml		process_wmic.yml	Macro'd powershell	Aug 17, 2021
process_wscript.yml		process_wscript.yml	update powershell analytics	Jan 14, 2025
prohibited_apps_launching_cmd_macro.yml		prohibited_apps_launching_cmd_macro.yml	ESCU Release v4.31.0	May 8, 2024
prohibited_softwares.yml		prohibited_softwares.yml	Release Branch - ESCU v4.34.0	Jun 26, 2024
ransomware_extensions.yml		ransomware_extensions.yml	output normalisation	Mar 5, 2025
ransomware_notes.yml		ransomware_notes.yml	Changed json to yml	Oct 16, 2019
remote_access_software_usage_exceptions.yml		remote_access_software_usage_exceptions.yml	Modified macro name for clarity, updated how to implements with details	Jul 26, 2024
remoteconnectionmanager.yml		remoteconnectionmanager.yml	update: windows event log macros	Jan 30, 2025
remove_valid_domains.yml		remove_valid_domains.yml	Changed json to yml	Oct 16, 2019
risk_index.yml		risk_index.yml	fix env typo in macros	Nov 26, 2024
s3_accesslogs.yml		s3_accesslogs.yml	fix env typo in macros	Nov 26, 2024
security_content_ctime.yml		security_content_ctime.yml	Present times in ISO8601 instead of US style	Aug 12, 2020
security_content_summariesonly.yml		security_content_summariesonly.yml	Release Branch - ESCU v4.34.0	Jun 26, 2024
security_group_api_calls.yml		security_group_api_calls.yml	naming updates, jinja macros updates	Dec 16, 2019
stream_dns.yml		stream_dns.yml	fix env typo in macros	Nov 26, 2024
stream_http.yml		stream_http.yml	fix env typo in macros	Nov 26, 2024
stream_tcp.yml		stream_tcp.yml	fix env typo in macros	Nov 26, 2024
subjectinterfacepackage.yml		subjectinterfacepackage.yml	fix env typo in macros	Nov 26, 2024
summariesonly_config.yml		summariesonly_config.yml	Release Branch - ESCU v4.34.0	Jun 26, 2024
suricata.yml		suricata.yml	fix env typo in macros	Nov 26, 2024
suspicious_email_attachments.yml		suspicious_email_attachments.yml	naming updates, jinja macros updates	Dec 16, 2019
suspicious_writes.yml		suspicious_writes.yml	Changed json to yml	Oct 16, 2019
sysmon.yml		sysmon.yml	update: windows event log macros	Jan 30, 2025
system_network_configuration_discovery_tools.yml		system_network_configuration_discovery_tools.yml	additional updates and fixes	Jan 20, 2025
uacbypass_process_name.yml		uacbypass_process_name.yml	Release 4.19.0	Jan 10, 2024
uncommon_processes.yml		uncommon_processes.yml	Changed json to yml	Oct 16, 2019
windows_exchange_iis.yml		windows_exchange_iis.yml	update exchange macro	Feb 19, 2025
windows_shells.yml		windows_shells.yml	fix env typo in macros	Nov 26, 2024
wineventlog_application.yml		wineventlog_application.yml	update: windows event log macros	Jan 30, 2025
wineventlog_rdp.yml		wineventlog_rdp.yml	update: windows event log macros	Jan 30, 2025
wineventlog_security.yml		wineventlog_security.yml	update: windows event log macros	Jan 30, 2025
wineventlog_system.yml		wineventlog_system.yml	update: windows event log macros	Jan 30, 2025
wineventlog_task_scheduler.yml		wineventlog_task_scheduler.yml	update: windows event log macros	Jan 30, 2025
wmi.yml		wmi.yml	update: windows event log macros	Jan 30, 2025
zeek_rpc.yml		zeek_rpc.yml	remove index	Dec 18, 2024
zeek_ssl.yml		zeek_ssl.yml	remove index	Dec 18, 2024
zeek_x509.yml		zeek_x509.yml	fix env typo in macros	Nov 26, 2024
zscaler_proxy.yml		zscaler_proxy.yml	fix env typo in macros	Nov 26, 2024
View all files